Use pip behind restrictive proxy


I’m trying to install packages via pip over the internet. My attempts failed so far because I’m sitting behind a restrictive proxy (at least that’s my guess of what is causing the error). I tried on several machines in the same network but didn’t suceed yet. I could reproduce the error with Python 3.8 and 3.9 on Windows 10 (64bit). However, I don’t really understand the problem, because I can normally browse the internet. Also, I’m using R on the same machine and downloading and installing packages from CRAN through R is not a problem.

Any help is highly appreciated because manually downloading and installing packages with all dependencies in each virtual environment is driving me crazy.

CMD output:

C:\>python -m pip install sqlalchemy-access
Defaulting to user installation because normal site-packages is not writeable
ERROR: Exception:
Traceback (most recent call last):
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\cli\", line 173, in _main
    status =, args)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\cli\", line 203, in wrapper
    return func(self, options, args)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\commands\", line 315, in run
    requirement_set = resolver.resolve(
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\resolution\resolvelib\", line 94, in resolve
    result = self._result = resolver.resolve(
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\resolvelib\", line 472, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\resolvelib\", line 341, in resolve
    self._add_to_criteria(self.state.criteria, r, parent=None)
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\resolvelib\", line 172, in _add_to_criteria
    if not criterion.candidates:
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\resolvelib\", line 151, in __bool__
    return bool(self._sequence)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\resolution\resolvelib\", line 140, in __bool__
    return any(self)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\resolution\resolvelib\", line 128, in <genexpr>
    return (c for c in iterator if id(c) not in self._incompatible_ids)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\resolution\resolvelib\", line 29, in _iter_built
    for version, func in infos:
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\resolution\resolvelib\", line 272, in iter_index_candidate_infos
    result = self._finder.find_best_candidate(
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\index\", line 851, in find_best_candidate
    candidates = self.find_all_candidates(project_name)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\index\", line 798, in find_all_candidates
    page_candidates = list(page_candidates_it)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\index\", line 134, in page_candidates
    yield from self._candidates_from_page(self._link)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\index\", line 758, in process_project_url
    html_page = self._link_collector.fetch_page(project_url)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\index\", line 490, in fetch_page
    return _get_html_page(location, session=self.session)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\index\", line 400, in _get_html_page
    resp = _get_html_response(url, session=session)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\index\", line 115, in _get_html_response
    resp = session.get(
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\requests\", line 555, in get
    return self.request('GET', url, **kwargs)
  File "C:\Program Files\Python39\lib\site-packages\pip\_internal\network\", line 454, in request
    return super().request(method, url, *args, **kwargs)
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\requests\", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\requests\", line 655, in send
    r = adapter.send(request, **kwargs)
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\cachecontrol\", line 53, in send
    resp = super(CacheControlAdapter, self).send(request, **kw)
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\requests\", line 439, in send
    resp = conn.urlopen(
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\urllib3\", line 696, in urlopen
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\urllib3\", line 964, in _prepare_proxy
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\urllib3\", line 359, in connect
    conn = self._connect_tls_proxy(hostname, conn)
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\urllib3\", line 500, in _connect_tls_proxy
    return ssl_wrap_socket(
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\urllib3\util\", line 453, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls)
  File "C:\Program Files\Python39\lib\site-packages\pip\_vendor\urllib3\util\", line 495, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock)
  File "C:\Program Files\Python39\lib\", line 500, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\Program Files\Python39\lib\", line 997, in _create
    raise ValueError("check_hostname requires server_hostname")
ValueError: check_hostname requires server_hostname

I’m trying to install packages via pip over the internet. My
attempts failed so far because I’m sitting behind a restrictive
proxy (at least that’s my guess of what is causing the error).
ValueError: check_hostname requires server_hostname

I have a suspicion your proxy doesn’t work with SNI, you might try
some of the workarounds in the comments here:

Thanks for the fast reply!
I tried the following but this didn’t change console output:

python -m pip install --trusted-host --trusted-host sqlalchemy-access

Unfortunately, most workarounds in these comments deal with python versions not supporting SNI and not with proxies not supporting SNI.
Do you know whether I can check somehow whether my proxy supports SNI or not? Couldn’t find something via google search.

It looks like a bug in urllib3. It’s using an SSLContext with hostname verification enabled, but does not pass a server_hostname to wrap_socket.

you may want to setup your pip environment (variables) to support/know your proxy, check your HTTP_PROXY or

proxy = http://user:password@proxy_name:port

Hey, thanks for your answer!
OK, if it’s a bug it seems only to occur with proxies, because outside my company network I can install packages with pip on other machines just normal. Do you have an idea how to solve this bug? Sorry, I’m just a python beginner and don’t really know how urllib3 works. Thanks!

Thank for the answer!
I couldn’t find pip.ini on my machine but I tried:
setting HTTP_PROXY and HTTPS_PROXY via:

C:\>set http_proxy=http://proxy:port

C:\>set https_proxy=https://proxy:port

I also tried to set the proxy with pip in different ways:

C:\>python -m pip install --proxy=http://username:password@proxy:port sqlalchemy-access
C:\>python -m pip install --proxy=https://username:password@proxy:port sqlalchemy-access
C:\>python -m pip install --proxy=https://proxy:port sqlalchemy-access
C:\>python -m pip install --proxy=http://proxy:port sqlalchemy-access

Unfortunately I still get the same error with these changes.

I recommend that you open a bug at GitHub - pypa/pip: The Python package installer . It looks like pip includes a copy of urllib3 that does not work correctly for proxy URLs that use an IP address. It is missing the fix Lean on SSLContext to verify hostnames when possible by pquentin · Pull Request #2178 · urllib3/urllib3 · GitHub .

Ok, this is probably a dumb question but I’m gonna ask anyway.
Did you put that literally or did you replaced proxy with your proxy’s IP address or hostname? Same with port to actual port number like 3128 or 8080. username with your actual username and your password?

ie. http_proxy=http://rob:rob_password@

Hey, thanks, I will open a bug. Do you have an idea for a quick fix additionally? Would be good to know if you have something in mind. Thanks and cheers.

Hey, yeah, I did adjust the username, proxy and so on by my individual settings. But I didn’t want to post my password here, that’s why I used the general expression. :smile:
I also replaced special characters with percent-encoding.

1 Like