SSL CERTIFICATE_VERIFY_FAILED in aws cli

Question

I installed AWS CLI on the Windows server 2007 32bit.

aws --version
aws-cli/1.8.8 Python/2.7.9 Windows/2008Server 

I configure aws cl

Answer 1

Mine was resolved with:

pip install awscli --force-reinstall --upgrade

Answer 2

If you want to use SSL and not have to specify the --no-verify-ssl option, then you need to set the AWS_CA_BUNDLE environment variable. e.g from PowerShell:

setx AWS_CA_BUNDLE "C:\Users\UserX\Documents\RootCert.pem"

The PEM file is a saved copy of the root certificate for the AWS endpoint you are trying to connect to. To generate it, first export the certificate in DER format (For details on how to do this, see here). Then run the following command to convert to the PEM format:

openssl x509 -inform der -in "C:\Users\UserX\Documents\RootCert.der" -out RootCert.pem

If you are using Powershell and not bash, then you will need to first install openssl.

For a full list of environment variables supported by the AWS CLI, see here

Answer 3

I had the same issue on Windows 10. It happens to be due to the aws cli not reading the internet proxy setting from the Windows registry. Fixed same error by setting the environment variables HTTP_PROXY and HTTPS_PROXY to the corporate internet proxy. Hope it helps somebody!

Answer 4

I had a similar issue and solved it by setting the proxy as follows:

$ set HTTP_PROXY=http://proxy.example.com:1234

$ set HTTPS_PROXY=https://proxy.example.com:1234

Answer 5

I added the certificate to C:\Program Files\Amazon\AWSCLIV2\botocore\cacert.pem and it resolved the problem.

Answer 6

Problem most likely caused by corporate proxy. In my case I was running the commands on AWS CLI behind proxy server and was getting certificate error. So to get around this I added --no-verify-ssl flag. Though this is a bad idea, I used this as a temporary solution to get the job done until it is resolved by the network team.