[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

Why it happens

The AWS CLI does not trust your proxy's certificate, for example a self-signed certificate from your organisation's own certificate authority. AWS also lists using the wrong AWS Region as a cause.

Where you see it, and what it affects

The AWS CLI prints this when it opens a secure connection to an AWS endpoint, for example on aws s3 ls, and cannot find the certificate authority in its local registry. It is common behind proxies that inspect traffic. A related message, "SSL validation failed for <region> [Errno 2] No such file or directory", means the ca_bundle path is wrong.

How to fix it

1. 1

   Step 1

   Get your organisation's certificate bundle as a .pem file from your network team.

2. 2

   Step 2

   Point the AWS CLI to it with the ca_bundle setting in the config file, the --ca-bundle option, or the AWS_CA_BUNDLE environment variable.

3. 3

   Step 3

   Check the Region is correct in the --region option, the AWS_DEFAULT_REGION variable or the region profile setting.

aws s3 ls --ca-bundle /path/to/ca-bundle.pem

Check that it is fixed

• Run aws s3 ls again (with your ca_bundle setting in place) and confirm it returns results without an SSL error.
• Run aws configure list and confirm the region value is the Region your resources are in.
• If you see "No such file or directory", confirm the .pem path in ca_bundle or AWS_CA_BUNDLE exists.

Source