Fix "CERTIFICATE_VERIFY_FAILED" in yt-dlp

What verification is actually doing

When yt-dlp connects to a site over HTTPS, the site presents a certificate. yt-dlp checks it was signed by an authority it trusts, and that the current time falls inside its validity window. Three separate things can make that fail, and the error text is the same for all three.

The trust store yt-dlp uses is Python's, not your browser's — which is why "it works in Chrome" tells you nothing about this error.

Cause 1 — the clock

A certificate valid from March 2026 to June 2026 fails verification if your machine believes it is 2019. The message says nothing about time. This is common on machines that have been off for months, on virtual machines restored from a snapshot, and on any device with a dead CMOS battery.

Cause 2 — a stale trust store

Certificate authorities change. A Python install from a few years ago carries a bundle that predates authorities in use today. On macOS specifically, Python from python.org does not use the system store at all and ships a script you have to run once:

On Linux, refresh the system bundle:

The standalone yt-dlp binary bundles its own certificates and sidesteps this class of problem entirely — one of several reasons the binary is often the better install.

Cause 3 — something is inspecting your traffic

Corporate proxies, school networks and HTTPS-scanning antivirus all work the same way: they terminate the connection, look inside, and re-sign it with their own certificate. Your browser trusts that certificate because IT installed it into the OS store. Python's bundle has never heard of it.

The correct fix is to give yt-dlp the same certificate, not to turn verification off:

Confirming the diagnosis

If this succeeds, the connection itself is fine and the trust chain is the whole problem:

And this shows you what is actually presenting a certificate — if the issuer is your antivirus or your employer rather than a public authority, cause 3 is confirmed:

If it still fails

• Only on one site. That site's chain may genuinely be misconfigured — a missing intermediate certificate is a real and common server-side mistake. Browsers paper over it by fetching the missing link; Python does not.
• Only under Docker. Slim base images ship almost no certificates. Add ca-certificates to the image; the Docker guide has a working Dockerfile.
• Only over a VPN. Some VPN clients install their own root and intercept DNS. Test with it off to confirm.
• Windows, "unable to get local issuer certificate" on everything. Usually a security suite. Its HTTPS scanning module can be turned off without uninstalling the product.