SSH连接HPC集群虚拟环境安装pip包时出现TLS/SSL证书错误

问题场景 #

在HPC集群的虚拟环境metaTS_venv中执行安装命令：

(metaTS_venv) [xxxuser@hpc metaTS]$ pip3 install pandas

出现SSL模块缺失导致的安装失败，主目录环境下安装正常，添加--trusted-host pypi.python.org无法解决，错误信息如下：

Could not fetch URL https://pypi.org/simple/pandas/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pandas/ (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available.")) - skipping
ERROR: Could not find a version that satisfies the requirement pandas (from versions: none)
ERROR: No matching distribution found for pandas
WARNING: pip is configured with locations that require TLS/SSL, however the ssl module in Python is not available.
Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available.")) - skipping

解决方法 #

• 重建带SSL支持的虚拟环境
  核心原因是创建虚拟环境时，基础Python未关联OpenSSL库。先清理现有环境，加载集群的OpenSSL模块后重新创建：

  # 删除现有虚拟环境
  rm -rf metaTS_venv
  # 加载集群OpenSSL模块（命令需根据集群配置调整，如module load openssl/1.1.1）
  module load openssl
  # 重新创建虚拟环境
  python3 -m venv metaTS_venv
  # 激活环境并升级pip
  source metaTS_venv/bin/activate
  pip install --upgrade pip
  # 安装目标包
  pip install pandas
  

• 临时指定SSL库路径
  若不想重建环境，激活虚拟环境后设置环境变量指向集群SSL库：

  source metaTS_venv/bin/activate
  # 替换为集群OpenSSL库的实际路径，可通过module show openssl查看
  export LD_LIBRARY_PATH=/path/to/openssl/lib:$LD_LIBRARY_PATH
  pip install pandas
  

• 使用集群本地PyPI镜像
  多数HPC集群会搭建本地镜像，无需SSL验证，直接指定镜像安装：

  pip install pandas -i http://[集群镜像地址]/simple --trusted-host [集群镜像地址]
  

  具体镜像地址可咨询集群管理员。

内容的提问来源于stack exchange，提问作者Sadeq Al-Ahdal