No, not as a habit. Pip's trusted-host option marks a host as trusted "even though it does not have valid or any HTTPS", so pip stops treating a bad certificate as a reason to refuse the connection. It silences the error and removes the protection. Fix the certificate trust problem instead.
What the option does
The pip reference describes it in one line: mark this host or host and port pair as trusted, even though it does not have valid or any HTTPS. The environment variable form is PIP_TRUSTED_HOST.
Contrast that with the default. The HTTPS certificates guide says pip performs SSL certificate verification for network connections it makes over HTTPS, and that this serves to prevent man in the middle attacks against package downloads.
So the trade is direct. You switch off the check that guards the download path for that host.
Why people reach for it
The typical story is an error like a certificate verify failure, often behind a corporate proxy that re-signs traffic with a company certificate authority. A search result suggests the trusted-host flag, the error goes away, and it ends up in a config file for years.
It spreads easily because it can live in a config file, an environment variable, or a Dockerfile line. See which pip configuration is in effect for how to find it.
Better fixes
Match the fix to the cause.
| Cause | Safer fix |
|---|---|
| Corporate proxy with its own CA | Trust that CA in pip |
| Private index with a private CA | Point pip at the CA bundle |
| Old system certificate store | Update the store or pip |
| Self signed test server | Use a proper certificate even in test |
The pip guide gives the supported paths. The cert option, or the PIP_CERT variable, specifies a different certificate bundle. The REQUESTS_CA_BUNDLE and CURL_CA_BUNDLE variables also work. And since pip 24.2, system certificates are used in addition to the bundled ones by default, through the truststore package. Versions before 24.2 needed an opt in flag. So upgrading pip may fix the original error with no workaround at all.
python -m pip install --cert /etc/ssl/company-ca.pem -r requirements.txt
See also trust a private CA in Node, Python, Java and curl.
When an exception might be tolerable
An isolated lab with no sensitive code, over a network you control, for a short test. Even then, write down an expiry. In anything that builds production artifacts, treat the option as a finding.
How to find and remove it
- Search repos and images for trusted-host, PIP_TRUSTED_HOST and pip.conf files.
- For each hit, find the original error and fix its cause.
- Add a CI check that fails if the option appears in committed files.
- Combine with hash checking, so even a compromised path cannot change what installs. See how pip hash checking works.
Safeguard's policies and gates can enforce rules on pull requests, which can include blocking changes that add insecure pip settings to a repository. A free scan is available at gold.safeguard.sh/scan.
Quick check
Does trusted-host disable hash checking?
No, they are separate. But trusted-host removes certificate protection, so hashes become your main defence for that host.
Why did my certificate error vanish after upgrading pip?
Pip 24.2 and later use system certificates in addition to the bundled ones by default, which fixes many proxy related errors.
Sources
Last reviewed: 19 October 2026.
