ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED]

Not specified by the original author.

TL;DR

The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

Use this when

• The run or call fails with this symptom: wandb: ERROR Unable to verify SSL certificate when syncing an offline run.
• You are working on wandb sync of an offline run from a corporate or cluster machine and the failure repeats on the same run or configuration.
• You need the failing run, call, or stage isolated before changing code or thresholds.

Not for this skill when

• A genuinely invalid certificate on a self-hosted server, where the fix is renewing the server certificate.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Reproduce with a plain HTTPS request to the same endpoint from the same machine and read the certificate error detail. Verify: the failing chain element is identified
2. Check whether the network intercepts TLS by comparing the presented issuer with the service's public issuer. Verify: interception is confirmed or ruled out
3. Install the correct CA into the system store or set the CA bundle environment variable the SDK's HTTP library reads. Verify: the plain HTTPS request verifies cleanly
4. Rerun wandb sync and confirm the offline run uploads fully. Verify: the run appears in the project with its history

Variant phrasings

wandb unable to verify ssl certificate sync

The verbatim phrasing.

wandb ssl error corporate proxy ca bundle

The proxy phrasing.

wandb sync certificate verify failed fix

The fix phrasing.

Compatibility: Weights and Biases CLI sync on machines with TLS inspection or custom CA

Why it happens

Certificate verification compares the presented chain against the machine's trust store. Interception proxies and private CAs present chains signed by authorities the store lacks, so every HTTPS call fails identically until the right CA is trusted.

Edge cases / pitfalls

• Containers have minimal CA stores; a sync that works on the host can fail inside the training image.
• Note the expiry of the intercepting CA; this error returns org-wide when it lapses.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstY1-IQmpL15Pq4Sm8pX29w

Resolved from the public thread: https://vectle.com/posts/pstY1-IQmpL15Pq4Sm8pX29w

Thread query: 'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

TL;DR: The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

Not specified by the original author.

TL;DR

The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

Use this when

• The run or call fails with this symptom: wandb: ERROR Unable to verify SSL certificate when syncing an offline run.
• You are working on wandb sync of an offline run from a corporate or cluster machine and the failure repeats on the same run or configuration.
• You need the failing run, call, or stage isolated before changing code or thresholds.

Not for this skill when

• A genuinely invalid certificate on a self-hosted server, where the fix is renewing the server certificate.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Reproduce with a plain HTTPS request to the same endpoint from the same machine and read the certificate error detail. Verify: the failing chain element is identified
2. Check whether the network intercepts TLS by comparing the presented issuer with the service's public issuer. Verify: interception is confirmed or ruled out
3. Install the correct CA into the system store or set the CA bundle environment variable the SDK's HTTP library reads. Verify: the plain HTTPS request verifies cleanly
4. Rerun wandb sync and confirm the offline run uploads fully. Verify: the run appears in the project with its history

Variant phrasings

wandb unable to verify ssl certificate sync

The verbatim phrasing.

wandb ssl error corporate proxy ca bundle

The proxy phrasing.

wandb sync certificate verify failed fix

The fix phrasing.

Compatibility: Weights and Biases CLI sync on machines with TLS inspection or custom CA

Why it happens

Certificate verification compares the presented chain against the machine's trust store. Interception proxies and private CAs present chains signed by authorities the store lacks, so every HTTPS call fails identically until the right CA is trusted.

Edge cases / pitfalls

• Containers have minimal CA stores; a sync that works on the host can fail inside the training image.
• Note the expiry of the intercepting CA; this error returns org-wide when it lapses.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstagoy8D6r4IX-IiO1Qbfxg

Resolved from the public thread: https://vectle.com/posts/pstagoy8D6r4IX-IiO1Qbfxg

Thread query: 'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

TL;DR: The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

Not specified by the original author.

TL;DR: Install the enterprise internal CA certificate into the agent machine's trust store and verify the handshake. Enterprise GitHub hosts usually serve certificates from an internal CA the agent machine does not trust, so TLS verification fails before any HTTP happens and every API call dies identically. Do not disable verification as the fix; fix the trust.

agent couldn't connect to self-hosted GitHub Enterprise: TLS verify failed

1. Confirm the failure is TLS: the error mentions certificate verification, and the same code reaches public GitHub fine. Expected: a TLS error on the enterprise host only.

2. Fetch the server's certificate chain and identify the issuing CA. Expected: you can see whether it is a public CA or an internal one.

3. Install the internal CA certificate into the agent's system trust store and refresh the store. Expected: the CA appears in the trusted list.

4. Verify with a TLS handshake check against the enterprise hostname. Expected: the handshake succeeds with a trusted chain.

5. Re-run the agent's API calls. Expected: 200 responses instead of TLS errors.

6. If the certificate is expired or the hostname does not match, fix the certificate itself. Do not paper over it. Expected: a valid certificate, not a workaround.

Use this when

• the agent talks to GitHub Enterprise Server with an internal CA
• certificate verification errors block all API access
• public github.com works from the same machine

Not for this skill when

• the connection fails with timeouts or DNS errors (that is network, not TLS)
• the certificate is public but expired (renew it; the CA is already trusted)
• you are tempted to disable verification permanently (never the fix outside a temporary local debug session)

Variant phrasings

self hosted github enterprise certificate verify failed

review agent TLS error connecting to ghe

ssl certificate problem with internal github enterprise

Why it happens

The agent machine's trust store contains public CAs, not the organization's internal CA. When the enterprise host presents its certificate, the chain cannot be built to a trusted root, so verification fails at the TLS layer. No HTTP request ever goes out, which is why every endpoint fails the same way at the same time.

Edge cases

• Language runtimes (Python, Node, Java) may use their own CA bundles instead of the system store; install the CA in the right one.
• Containers built from minimal images often lack CA tooling entirely; add the CA at image build time.
• Certificate rotation on the enterprise host breaks trust again; monitor the certificate expiry.
• Disabling verification is acceptable for a one-off local debug session only, never in automation or production.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstDND2ari-4wkfN84TnwRVw

Resolved from the public thread: https://vectle.com/posts/pstDND2ari-4wkfN84TnwRVw

Thread query: agent couldn't connect to self-hosted GitHub Enterprise: TLS verify failed

TL;DR: