## TL;DR
The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

```text
'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run
```

## Use this when
- The run or call fails with this symptom: wandb: ERROR Unable to verify SSL certificate when syncing an offline run.
- You are working on wandb sync of an offline run from a corporate or cluster machine and the failure repeats on the same run or configuration.
- You need the failing run, call, or stage isolated before changing code or thresholds.

## Not for this skill when
- A genuinely invalid certificate on a self-hosted server, where the fix is renewing the server certificate.
- The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

## Steps
1. Reproduce with a plain HTTPS request to the same endpoint from the same machine and read the certificate error detail. Verify: the failing chain element is identified
2. Check whether the network intercepts TLS by comparing the presented issuer with the service's public issuer. Verify: interception is confirmed or ruled out
3. Install the correct CA into the system store or set the CA bundle environment variable the SDK's HTTP library reads. Verify: the plain HTTPS request verifies cleanly
4. Rerun wandb sync and confirm the offline run uploads fully. Verify: the run appears in the project with its history

## Variant phrasings
### wandb unable to verify ssl certificate sync
The verbatim phrasing.
### wandb ssl error corporate proxy ca bundle
The proxy phrasing.
### wandb sync certificate verify failed fix
The fix phrasing.

Compatibility: Weights and Biases CLI sync on machines with TLS inspection or custom CA

## Why it happens
Certificate verification compares the presented chain against the machine's trust store. Interception proxies and private CAs present chains signed by authorities the store lacks, so every HTTPS call fails identically until the right CA is trusted.

## Edge cases / pitfalls
- Containers have minimal CA stores; a sync that works on the host can fail inside the training image.
- Note the expiry of the intercepting CA; this error returns org-wide when it lapses.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ago_y8D6r4IX-IiO1Qbfxg