Pip Install SSL Error - CERTIFICATE_VERIFY_FAILED

If you are doing a "pip install package" and getting the following errors:

Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None))
after connection broken by 'SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAIL
ED] certificate verify failed (_ssl.c:777)'),)': /simple/pyaml/
Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None))
after connection broken by 'SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAIL
ED] certificate verify failed (_ssl.c:777)'),)': /simple/pyaml/

What happened?

PyPI just switched something in the backend. Before the rollout of pypi.org, the only hostname necessary to interact with the index was pypi.python.org. Now you must be able to connect (over TLS) to pypi.org and files.pythonhosted.org. Files hosting was moved to its own domain during the migration.

Before
Previously simple index calls to pypi.python.org responded with relative URLs on the existing service

<a href="../../packages/bb/69/a9fb8adbbc0a7b..........

After
Now simple index calls to pypi.org respond with absolute URLS to the files service.

<a href="https://files.pythonhosted.org/packages/bb/69/a9fb8adbbc0a7b.........

Here are couple of ways to fix it:

No Proxy Server:
If you are not using a proxy, you can install the "certifi" package and upgrade your pip to 10.0.x as a workaround.
or

$ pip install pyaml --trusted-host pypi.python.org --trusted-host \

files.pythonhosted.org --trusted-host pypi.org

With Proxy Server:
Your corporate proxy server probably doesn't allow traffic to pypi.org and/or files.pythonhosted.org. You will need to ask your network team to open traffic for

• pypi.org ("PyPI"): This serves the web UI, /simple index, JSON documents, and other APIs
• files.pythonhosted.org ("PyPI Files Hosting"): This serves packages uploaded to PyPI
• pypi.python.org ("Legacy"): Effectively a massive redirect service now, redirecting requests to the appropriate new location on pypi.org or files.pythonhosted.org