conda build does not honour ssl_verify: truststore

[jaapdraad]

Checklist

• I added a descriptive title
• I searched open reports and couldn't find a duplicate

What happened?

We are using conda in combination with an internal Proget repository server using a local CA.
This used to work with ssl_verify: trustore.
However with the lastets version of Miniconda3, conda build doesn't seem to honour the ssl_verify trustore setting and we are getting SSL errors as shown below.
Other conda functions ( search, create) operate normally.

Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)'))': /conda/conda-main/win-64/repodata.json

Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)'))': /conda/conda-r/noarch/repodata.json

Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)'))': /conda/conda-r/win-64/repodata.json

Conda Info

active environment : base
    active env location : C:\ProgramData\miniconda3
            shell level : 1
       user config file : C:\Users\jdlouwere\.condarc
 populated config files : C:\ProgramData\miniconda3\.condarc
                          C:\ProgramData\miniconda3\condarc.d\anaconda-auth.yml
                          C:\Users\jdlouwere\.condarc
          conda version : 26.5.2
    conda-build version : 26.5.0
         python version : 3.13.13.final.0
                 solver : libmamba (default)
       virtual packages : __archspec=1=x86_64_v3
                          __conda=26.5.2=0
                          __cuda=12.2=0
                          __win=10.0.26100=0
       base environment : C:\ProgramData\miniconda3  (read only)
      conda av data dir : C:\ProgramData\miniconda3\etc\conda
  conda av metadata url : None
           channel URLs : https://proget.marin.local/conda/conda-main/win-64
                          https://proget.marin.local/conda/conda-main/noarch
                          https://proget.marin.local/conda/conda-r/win-64
                          https://proget.marin.local/conda/conda-r/noarch
                          https://proget.marin.local/conda/conda-msys2/win-64
                          https://proget.marin.local/conda/conda-msys2/noarch
          package cache : C:\ProgramData\miniconda3\pkgs
                          C:\Users\jdlouwere\.conda\pkgs
                          C:\Users\jdlouwere\AppData\Local\conda\conda\pkgs
       envs directories : C:\Users\jdlouwere\.conda\envs
                          C:\ProgramData\miniconda3\envs
                          C:\Users\jdlouwere\AppData\Local\conda\conda\envs
    temporary directory : C:\Users\JDLOUW~1\AppData\Local\Temp
               platform : win-64
             user-agent : conda/26.5.2 requests/2.34.2 CPython/3.13.13 Windows/11 Windows/10.0.26100 solver/libmamba conda-libmamba-solver/26.4.2 libmambapy/2.3.2 aau/0.8.1 c/. s/.
          administrator : False
             netrc file : None
           offline mode : False

Conda Config

==> C:\ProgramData\miniconda3\.condarc <==
auto_update_conda: False
auto_activate_base: False
ssl_verify: truststore
channels:
  - defaults
custom_multichannels:
  marin: ('https://proget.marin.local/conda/conda_marin_main', 'https://proget.marin.local/conda/conda_marin_forge')
  marin-staging: ('https://proget.marin.local/conda/conda_marin_staging',)
  marin-buildfarm: ('https://proget.marin.local/conda/conda_marin_buildfarm',)
conda_build:
  pkg_format: 2

==> C:\ProgramData\miniconda3\condarc.d\anaconda-auth.yml <==
channel_settings:
  - channel: https://repo.anaconda.cloud/*
    auth: anaconda-auth

==> C:\Users\jdlouwere\.condarc <==
auto_update_conda: False
auto_activate_base: False
ssl_verify: truststore
channel_alias: https://proget.marin.local/conda
channels:
  - defaults
custom_multichannels:
  marin: ('https://proget.marin.local/conda/conda_marin_main', 'https://proget.marin.local/conda/conda_marin_forge')
  marin-staging: ('https://proget.marin.local/conda/conda_marin_staging',)
  defaults: ('https://proget.marin.local/conda/conda-main', 'https://proget.marin.local/conda/conda-r', 'https://proget.marin.local/conda/conda-msys2')
  marin-buildfarm: ('https://proget.marin.local/conda/conda-main', 'https://proget.marin.local/conda/conda-r', 'https://proget.marin.local/conda/conda-msys2')

==> envvars <==
allow_softlinks: False

Conda list

# packages in environment at C:\ProgramData\miniconda3:
#
# Name                        Version          Build                  Channel
anaconda-anon-usage           0.8.1            pyhb46e38b_100         marin-buildfarm
anaconda-auth                 0.15.0           py313haa95532_0        marin-buildfarm
anaconda-cli-base             0.8.2            py313haa95532_0        marin-buildfarm
anaconda-client               1.14.1           py313haa95532_0        marin-buildfarm
anaconda-navigator            2.7.1            py313haa95532_0        marin-buildfarm
anaconda_powershell_prompt    1.1.0            haa95532_1             marin-buildfarm
anaconda_prompt               1.1.0            haa95532_1             marin-buildfarm
annotated-doc                 0.0.4            py313haa95532_0        marin-buildfarm
annotated-types               0.6.0            py313haa95532_1        marin-buildfarm
anyio                         4.12.1           py313haa95532_0        marin-buildfarm
aom                           3.13.2           h8ecca34_0             marin-buildfarm
archspec                      0.2.5            pyhd3eb1b0_0           marin-buildfarm
attrs                         26.1.0           py313h35db113_0        marin-buildfarm
beautifulsoup4                4.14.3           py313haa95532_0        marin-buildfarm
blas                          1.0              mkl                    marin-buildfarm
boltons                       25.0.0           py313haa95532_0        marin-buildfarm
brotlicffi                    1.2.0.0          py313h885b0b7_0        marin-buildfarm
bzip2                         1.0.8            h2bbff1b_6             marin-buildfarm
ca-certificates               2026.5.14        haa95532_0             marin-buildfarm
cairo                         1.18.4           h012aecd_0             marin
certifi                       2026.5.20        py313haa95532_0        marin-buildfarm
cffi                          2.0.0            py313h02ab6af_1        marin-buildfarm
chardet                       5.2.0            py313haa95532_0        marin-buildfarm
charset-normalizer            3.4.4            py313haa95532_0        marin-buildfarm
click                         8.2.1            py313haa95532_1        marin-buildfarm
colorama                      0.4.6            py313haa95532_0        marin-buildfarm
conda                         26.5.2           py313haa95532_0        marin-buildfarm
conda-build                   26.5.0           py313h4f6777b_0        marin-buildfarm
conda-index                   0.11.0           py313haa95532_0        marin-buildfarm
conda-libmamba-solver         26.4.2           pyh3785b3c_0           marin-buildfarm
conda-lockfiles               0.2.0            py313haa95532_0        marin-buildfarm
conda-pack                    0.9.1            py313haa95532_0        marin-buildfarm
conda-package-handling        2.4.0            py313haa95532_1        marin-buildfarm
conda-package-streaming       0.12.0           py313haa95532_1        marin-buildfarm
conda-pypi                    0.9.0            py313haa95532_1        marin-buildfarm
conda-rattler-solver          0.1.0            py313haa95532_0        marin-buildfarm
conda-repo-cli                1.0.173          py313haa95532_1        marin-buildfarm
conda-self                    0.2.0            py313haa95532_0        marin-buildfarm
conda-standalone              26.3.2.post1     h2802e11_single_0      marin-buildfarm
constructor                   3.15.3           py313haa95532_0        marin-buildfarm
cpp-expected                  1.1.0            h214f63a_0             marin-buildfarm
cryptography                  46.0.7           py313hbfe00f4_0        marin-buildfarm
dav1d                         1.5.3            h6ac4d88_0             marin-buildfarm
defusedxml                    0.7.1            pyhd3eb1b0_0           marin-buildfarm
distro                        1.9.0            py313haa95532_0        marin-buildfarm
evalidate                     2.0.3            py313haa95532_0        marin-buildfarm
expat                         2.8.1            hd7fb8db_0             marin-buildfarm
filelock                      3.20.3           py313haa95532_0        marin-buildfarm
fmt                           11.2.0           h58b7f6e_0             marin-buildfarm
fontconfig                    2.15.0           hd211d86_0             marin-buildfarm
freeglut                      3.8.0            hfcef157_0             marin-buildfarm
freetype                      2.14.1           hfbffc0b_0             marin-buildfarm
fribidi                       1.0.16           h5da207d_1             marin-buildfarm
frozendict                    2.4.6            py313h02ab6af_0        marin-buildfarm
graphite2                     1.3.14           hd77b12b_1             marin-buildfarm
h11                           0.16.0           py313haa95532_1        marin-buildfarm
harfbuzz                      12.3.0           h3ef6528_1             marin-buildfarm
httpcore                      1.0.9            py313haa95532_0        marin-buildfarm
httpx                         0.28.1           py313haa95532_1        marin-buildfarm
icu                           73.1             h6c2663c_0             marin-buildfarm
idna                          3.18             py313haa95532_0        marin-buildfarm
intel-openmp                  2025.0.0         haa95532_1165          marin-buildfarm
jaraco.classes                3.4.0            py313haa95532_0        marin-buildfarm
jaraco.context                6.1.0            py313haa95532_0        marin-buildfarm
jaraco.functools              4.4.0            py313haa95532_0        marin-buildfarm
jinja2                        3.1.6            py313haa95532_0        marin-buildfarm
jpeg                          9f               ha349fce_0             marin-buildfarm
jsonpatch                     1.33             py313haa95532_1        marin-buildfarm
jsonpointer                   3.1.1            py313haa95532_0        marin-buildfarm
jsonschema                    4.25.1           py313haa95532_0        marin-buildfarm
jsonschema-specifications     2025.9.1         py313haa95532_0        marin-buildfarm
jupyter_core                  5.9.1            py313haa95532_0        marin-buildfarm
keyring                       25.7.0           py313haa95532_0        marin-buildfarm
lcms2                         2.19             h03dfe48_0             marin-buildfarm
lerc                          4.1.0            hd7fb8db_2             marin-buildfarm
libabseil                     20260107.0       cxx17_hc587421_0       marin-buildfarm
libarchive                    3.8.2            h6c023e8_0             marin-buildfarm
libavif                       1.3.0            h87e066f_1             marin-buildfarm
libbrotlicommon               1.2.0            h907acca_0             marin-buildfarm
libbrotlidec                  1.2.0            h02c67a5_0             marin-buildfarm
libbrotlienc                  1.2.0            h483e6b9_0             marin-buildfarm
libclang13                    22.1.2           default_h463168d_0     marin-buildfarm
libcurl                       8.20.0           h9440e04_1             marin-buildfarm
libdeflate                    1.22             h2466b09_0             marin
libevent                      2.1.12           h56d1f94_1             marin-buildfarm
libexpat                      2.8.1            hd7fb8db_0             marin-buildfarm
libffi                        3.4.8            h2b21627_2             marin-buildfarm
libglib                       2.86.3           h9bccc14_0             marin-buildfarm
libhwloc                      2.12.1           default_hfa10c62_1000  marin-buildfarm
libiconv                      1.18             hc89ec93_0             marin-buildfarm
libkrb5                       1.22.1           h3d06f0e_1             marin-buildfarm
liblief                       0.17.5           h0c1e6ba_0             marin-buildfarm
libllvm22                     22.1.2           h48dad37_1             marin-buildfarm
libmamba                      2.3.2            hc213065_1             marin-buildfarm
libmambapy                    2.3.2            py313h364efb6_1        marin-buildfarm
libmpdec                      4.0.0            h827c3e9_0             marin-buildfarm
libopenjpeg                   2.5.4            h02ab6af_1             marin-buildfarm
libpng                        1.6.56           h2854ad3_0             marin-buildfarm
libpq                         17.9             hb13705e_1             marin-buildfarm
libre2-11                     2025.11.05       h797e85b_1             marin-buildfarm
libsolv                       0.7.30           h23a355e_2             marin-buildfarm
libssh2                       1.11.1           h9de5364_1000          marin
libtiff                       4.7.1            h3a18249_0             marin-buildfarm
libwebp-base                  1.6.0            hbf3958f_0             marin-buildfarm
libxml2                       2.13.9           h6201b9f_0             marin-buildfarm
libxslt                       1.1.43           hd1fac9c_0             marin-buildfarm
libzlib                       1.3.1            h1c6eee0_1             marin-buildfarm
lz4-c                         1.9.4            h2bbff1b_1             marin-buildfarm
markdown-it-py                4.0.0            py313haa95532_2        marin-buildfarm
markupsafe                    3.0.2            py313h827c3e9_0        marin-buildfarm
mbedtls                       3.5.1            h5da7b33_1             marin-buildfarm
mdurl                         0.1.2            py313haa95532_0        marin-buildfarm
menuinst                      2.4.2            py313h885b0b7_1        marin-buildfarm
mkl                           2025.0.0         h585ebfc_931           marin-buildfarm
mkl-service                   2.5.2            py313h0b37514_0        marin-buildfarm
mkl_fft                       2.2.0            py313h18b77b3_0        marin-buildfarm
mkl_random                    1.3.0            py313h42c1672_0        marin-buildfarm
more-itertools                11.0.2           py313haa95532_0        marin-buildfarm
msgpack-python                1.1.1            py313h5da7b33_0        marin-buildfarm
msys2-gcc-libs                13.3.0           1000                   marin-buildfarm
msys2-libiconv                1.17             1000                   marin-buildfarm
msys2-libintl                 0.22.4           1000                   marin-buildfarm
msys2-msys-mutex              1.0              msys2                  marin-buildfarm
msys2-msys2-runtime           3.5.4            1000                   marin-buildfarm
msys2-patch                   2.7.6            2000                   marin-buildfarm
msys2-zlib                    1.3.1            1000                   marin-buildfarm
mysql-common                  9.3.0            h0b12ad4_6             marin-buildfarm
mysql-libs                    9.3.0            h08a8c37_6             marin-buildfarm
navigator-updater             0.6.0            py313haa95532_1        marin-buildfarm
nbformat                      5.10.4           py313haa95532_0        marin-buildfarm
nlohmann_json                 3.11.2           h6c2663c_0             marin-buildfarm
nsis                          3.12             h59dde2d_log_0         marin-buildfarm
numpy                         2.4.6            py313h9606935_0        marin-buildfarm
numpy-base                    2.4.6            py313h89dd80d_0        marin-buildfarm
openssl                       3.5.6            hbb43b14_0             marin-buildfarm
packaging                     26.0             py313haa95532_0        marin-buildfarm
pcre2                         10.46            h5740b90_0             marin-buildfarm
pillow                        12.1.1           py313h9f28578_0        marin-buildfarm
pip                           26.1.1           pyhc872135_1           marin-buildfarm
pixman                        0.46.4           h4043f72_0             marin-buildfarm
pkce                          1.0.3            py313haa95532_0        marin-buildfarm
pkginfo                       1.12.1.2         py313haa95532_0        marin-buildfarm
platformdirs                  4.9.4            py313haa95532_0        marin-buildfarm
pluggy                        1.6.0            py313haa95532_0        marin-buildfarm
psutil                        7.0.0            py313h02ab6af_1        marin-buildfarm
py-lief                       0.17.5           py313h0c1e6ba_0        marin-buildfarm
py-rattler                    0.23.1           py313h51239a8_0        marin-buildfarm
py-rattler-build              0.61.4           py313h51239a8_0        marin-buildfarm
pybind11-abi                  5                hd3eb1b0_0             marin-buildfarm
pycosat                       0.6.6            py313h827c3e9_2        marin-buildfarm
pycparser                     3.0              py313haa95532_0        marin-buildfarm
pydantic                      2.13.4           py313haa95532_0        marin-buildfarm
pydantic-core                 2.46.4           py313h51239a8_0        marin-buildfarm
pydantic-settings             2.12.0           py313haa95532_0        marin-buildfarm
pygments                      2.20.0           py313haa95532_0        marin-buildfarm
pyjwt                         2.12.1           py313haa95532_0        marin-buildfarm
pyproject_hooks               1.2.0            py313haa95532_1        marin-buildfarm
pyside6                       6.10.2           py313h1f3a4f0_1        marin-buildfarm
pysocks                       1.7.1            py313haa95532_1        marin-buildfarm
python                        3.13.13          h39c999c_100_cp313     marin-buildfarm
python-build                  1.3.0            py313haa95532_1        marin-buildfarm
python-dateutil               2.9.0post0       py313haa95532_2        marin-buildfarm
python-dotenv                 1.2.1            py313haa95532_0        marin-buildfarm
python-fastjsonschema         2.21.2           py313haa95532_0        marin-buildfarm
python-installer              1.0.0            pyhd3eb1b0_0           marin-buildfarm
python-libarchive-c           5.3              py313haa95532_0        marin-buildfarm
python_abi                    3.13             3_cp313                marin-buildfarm
pytz                          2026.1.post1     py313haa95532_0        marin-buildfarm
pywin32                       311              py313h885b0b7_0        marin-buildfarm
pywin32-ctypes                0.2.3            py313haa95532_0        marin-buildfarm
pyyaml                        6.0.3            py313hb9a58be_0        marin-buildfarm
qtbase                        6.10.2           h7604b34_0             marin-buildfarm
qtdeclarative                 6.10.2           h1c18438_0             marin-buildfarm
qtpy                          2.4.3            py313haa95532_0        marin-buildfarm
qtshadertools                 6.10.2           h275cd7d_0             marin-buildfarm
qtsvg                         6.10.2           h83a203b_0             marin-buildfarm
qttools                       6.10.2           h3ada859_0             marin-buildfarm
qtwebchannel                  6.10.2           hdb80409_0             marin-buildfarm
qtwebengine                   6.10.2           hd09e237_0             marin-buildfarm
qtwebsockets                  6.10.2           he9ef41a_0             marin-buildfarm
rattler-build                 0.55.1           hff8fe86_0             marin-buildfarm
re2                           2025.11.05       hca2749c_1             marin-buildfarm
readchar                      4.2.1            py313haa95532_0        marin-buildfarm
referencing                   0.37.0           py313haa95532_0        marin-buildfarm
reproc                        14.2.7           h557c29b_0             marin-buildfarm
reproc-cpp                    14.2.7           h557c29b_0             marin-buildfarm
requests                      2.34.2           py313haa95532_0        marin-buildfarm
requests-toolbelt             1.0.0            py313haa95532_0        marin-buildfarm
rich                          15.0.0           py313haa95532_0        marin-buildfarm
rpds-py                       0.28.0           py313h114bc41_0        marin-buildfarm
ruamel.yaml                   0.18.16          py313hb9a58be_0        marin-buildfarm
ruamel.yaml.clib              0.2.14           py313hb9a58be_0        marin-buildfarm
semver                        3.0.4            py313haa95532_0        marin-buildfarm
setuptools                    82.0.1           py313haa95532_0        marin-buildfarm
shellingham                   1.5.4            py313haa95532_0        marin-buildfarm
simdjson                      3.10.1           h214f63a_0             marin-buildfarm
six                           1.17.0           py313haa95532_0        marin-buildfarm
snappy                        1.2.2            hab6b7b3_1             marin-buildfarm
soupsieve                     2.5              py313haa95532_0        marin-buildfarm
sqlite                        3.51.2           hee5a0db_0             marin-buildfarm
tabulate                      0.10.0           py313haa95532_0        marin-buildfarm
tbb                           2022.3.0         h90c84d6_0             marin-buildfarm
tbb-devel                     2022.3.0         h90c84d6_0             marin-buildfarm
tk                            8.6.15           h00eb95c_1000          marin
tomli                         2.4.0            py313haa95532_0        marin-buildfarm
tomlkit                       0.13.3           py313haa95532_0        marin-buildfarm
tqdm                          4.67.3           py313h4442805_1        marin-buildfarm
traitlets                     5.15.0           py313haa95532_0        marin-buildfarm
truststore                    0.10.4           py313haa95532_0        marin-buildfarm
typer                         0.25.1           py313haa95532_0        marin-buildfarm
typing-extensions             4.15.0           py313haa95532_0        marin-buildfarm
typing-inspection             0.4.2            py313haa95532_0        marin-buildfarm
typing_extensions             4.15.0           py313haa95532_0        marin-buildfarm
tzdata                        2026b            he532380_0             marin-buildfarm
ucrt                          10.0.22621.0     haa95532_0             marin-buildfarm
ujson                         5.11.0           py313h885b0b7_0        marin-buildfarm
unearth                       0.17.5           py313haa95532_1        marin-buildfarm
urllib3                       2.7.0            py313haa95532_0        marin-buildfarm
vc                            14.3             h2df5915_10            marin-buildfarm
vc14_runtime                  14.44.35208      h4927774_12            marin-buildfarm
vs2015_runtime                14.44.35208      ha6b5a95_12            marin-buildfarm
wheel                         0.46.3           py313haa95532_0        marin-buildfarm
win_inet_pton                 1.1.0            py313haa95532_1        marin-buildfarm
xz                            5.8.2            h53af0af_0             marin-buildfarm
yaml                          0.2.5            he774522_0             marin-buildfarm
yaml-cpp                      0.8.0            hd77b12b_1             marin-buildfarm
zlib                          1.3.1            h1c6eee0_1             marin-buildfarm
zstandard                     0.24.0           py313he335c29_0        marin-buildfarm
zstd                          1.5.7            h56299aa_0             marin-buildfarm

Additional Context

No response

[jaapdraad]

I was able to workaround this by using ssl_verify: false
or by using ssl_verify with a pem file conataining our internal CA certificate.

[danyeaw]

Hey @jaapdraad, thanks for submitting the issue. Are you using conda-build behind a proxy? This may be related to conda/conda#16252.

[jaapdraad]

Hey @jaapdraad, thanks for submitting the issue. Are you using conda-build behind a proxy? This may be related to conda/conda#16252.

No we are not using conda-build behind a proxy.

[jaapdraad]

In a prior version of conda (Miniconda3) everything still worked OK:
conda version : 24.11.0
conda-build version : 24.11.2
python version : 3.12.8.final.0

[jaapdraad]

@danyeaw And thanks for looking into this.

[danyeaw]

@jaapdraad, is there a minimum reproducible example you could provide that shows this without depending on your internal server, like some steps using a local channel?

[jaapdraad]

@jaapdraad, is there a minimum reproducible example you could provide that shows this without depending on your internal server, like some steps using a local channel?

I don't think our internal server has anything to do with this. As I pointed out things worked fine with a previous version of conda.
For reproduction you would need a local channel that requires https and a local CA with a root certificate stored in the Windows trust store.

I asked copilot what could be causing this issue (sorry for the lameness) and it suggested that the truststore conda package might me missing in one of the intermediate envs that are temporarily created in the build process. Howewer I wouldn't know how to verify that.

[danyeaw]

I tried to reproduce this locally using an HTTPS conda channel on localhost with a private CA trusted in the macOS system keychain and ssl_verify: truststore in condarc.

Environment

• macOS (arm64), miniforge, Python 3.12
• conda, conda-build, conda-libmamba-solver, truststore from conda-forge
• HTTPS channel served via Caddy with a self-signed CA (installed in macOS Keychain)
• Repro condarc: ssl_verify: truststore, solver: libmamba, channels: [https://localhost]

Result

• conda search against the channel: works
• conda-render with truststore: works, but InsecureRequestWarning (unverified HTTPS to localhost) — truststore doesn't seem applied in conda-build's index path
• conda-render with ssl_verify: true: fails with CERTIFICATE_VERIFY_FAILED on repodata.json.zst (same error as this issue)

Unfortunately, I couldn't reproduce the exact failure mode (truststore + build fails) on macOS. This may be Windows-specific. This testing also suggests inconsistent SSL config handling between conda CLI and conda-build's repodata fetch path.

@jaapdraad Do you have a set of steps to take on Windows to reproduce this?