--cert and global.cert not working

[mayermart]

pip version

21.0.1

Python version

3.9.1

OS

Windows 10 1909

Additional information

SSL Interception Proxy

Description

After updating to version 21.0.1 pip seems not to use provided certificates for ssl.

Expected behavior

pip should still use the provided certificate.

How to Reproduce

After a fresh install of Python 3.9.1 i set global.cert to "A:\path\to.crt"
The entry was successfully written to "C:\Users<user>\AppData\Roaming\pip\pip.ini".

So i updated pip from version 20.2.3 to 21.0.1 with "pip install --upgrade pip" which works fine.
But if i issue the command again i receive SSL Errors:

Output

PS C:\Python39> .\python.exe -m pip config set global.cert A:\path\to.crt
Writing to C:\Users<user>\AppData\Roaming\pip\pip.ini
PS C:\Python39> .\python.exe -m pip config list
global.cert='A:\path\to.crt'
PS C:\Python39> .\python.exe -m pip install --upgrade pip
Collecting pip
Using cached pip-21.0.1-py3-none-any.whl (1.5 MB)
Installing collected packages: pip
Attempting uninstall: pip
Found existing installation: pip 20.2.3
Uninstalling pip-20.2.3:
Successfully uninstalled pip-20.2.3
Successfully installed pip-21.0.1
PS C:\Python39> .\python.exe -m pip install --upgrade pip
Requirement already satisfied: pip in c:\python39\lib\site-packages (21.0.1)
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1123)'))': /simple/pip/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1123)'))': /simple/pip/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1123)'))': /simple/pip/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1123)'))': /simple/pip/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1123)'))': /simple/pip/
Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1123)'))) - skipping
PS C:\Python39>

Code of Conduct

• I agree to follow the PSF Code of Conduct

[mayermart]

Didn't saw it yesterday... Possible Duplicate of #9568

[CrazyBoyFeng]

Have you used a system proxy?
It may not be that --cert is not effective, but your certificate is used correctly, and the the proxy is used incorrectly (this bug).

[mayermart]

Yes, proxy is set as a system proxy. Without a protocol prefix.
If i can find some time i will test without system proxy and --proxy parameter instead.

[mayermart]

Meanwhile i manged to get pip working using the --cert paramter with the ssl interception certificate.