Invalid peer certificate issue with latest version

I’m behind a corporate proxy with a Mac and using the latest version (installed using homebrew) gives me the following error:

Checking for updates...
Unable to check for Anki versions. Please check your internet connection.

Error: Failed to run (2): /Applications/Anki.app/Contents/MacOS/uv run --no-project --no-config --managed-python --with pip-system-certs,requests[socks] --python 3.13.5 /Applications/Anki.app/Contents/Resources/versions.py: error: Failed to download https://github.com/astral-sh/python-build-standalone/releases/download/20250612/cpython-3.13.5%2B20250612-aarch64-apple-darwin-install_only_stripped.tar.gz
  Caused by: Request failed after 3 retries
  Caused by: error sending request for url (https://github.com/astral-sh/python-build-standalone/releases/download/20250612/cpython-3.13.5%2B20250612-aarch64-apple-darwin-install_only_stripped.tar.gz)
  Caused by: client error (Connect)
  Caused by: invalid peer certificate: UnknownIssuer

There have been a few topics related to this. I wanted to add a link, but it wouldn’t let me… :confused:

The solution/workaround there is to use an older version. I’ve manually installed 25.02.7 and I can confirm that it still works there.

However, I’m wondering if this issue is being addressed? All the other topics have been automatically closed due to inactivity. And I haven’t found a corresponding issue on Github. I don’t completely understand what the process would be. Should I create an issue on Github? Or is this somewhere on the radar?

On a similar note, Anki doesn’t pick up my corporate proxy settings correctly if I start it using the application icon. I have to start it manually from a terminal where the http_proxy and https_proxy env variables are set accordingly, then it works. Any thoughts on how to fix this?

2 Likes

Tried to link the related issue, but can’t. It’s named “Installation error - invalid peer certificate - –native-tls?”, but there are others. This one is from August 22nd.

1 Like

In that case, probably there is noone working on it yet. Dae and abdo read the forums every few weeks and add entries to the issues tab on github. They might have missed the previous reports though.

It would be great if you could provide as many detailed infos as possible here on the forums, including steps to reproduce. Then, once a dev sees your report, it’ll be added to githubs issues. After that, either the devs or volunteers can work on it. You shouldn’t create an issue on github though, as the forums is prefered for this.

New users cannot send links. You can add a link by using code blocks though, like this forums.ankiweb.net. Anyways, thanks for providing the title. I’ll link it here: Installation error - invalid peer certificate - --native-tls?.

1 Like

Thanks a lot for the feedback. I’ll try to add more details. Reproduction will obviously depend on the networking infrastructure, but I could imagine that there are a few people that site behind a proxy…

System configuration:

  • Mac Book Pro, Sequoia 15.7.1 (but I guess the OS shouldn’t matter that much)
  • Access to Internet only via PreProxy, https://apps.apple.com/us/app/preproxy/id1237580019?mt=12
    - The PreProxy sits between the local application and the remote proxy, handling authentication, so the local application can use the proxy unauthenticated.
  • The proxy is set in both system settings as well as in the HTTP_PROXY and HTTPS_PROXY env variables

Problem 1 (with version 25.02.7, but also earlier and later):

  • Starting Anki via the regular application icon does not work - or rather in this case, it will for some reason not pick up the proxy settings and will not be able to sync any data from the Internet.
  • The workaround is to open a terminal (which will have the proxy env variables set), go to the directory /Application/Anki.app/Contents/MacOS and start ./anki from the terminal. Then, it will pick up the proxy settings correctly and everything works.

Problem 2 (versions > 25.02.7, including latest 25.09 available on homebrew):

  • With the new launcher, I cannot start the application at all. When the launcher checks for updates, there will be a invalid peer certificate: UnknownIssuer error. This is most likely due to the fact that the corporate reverse proxy will intercept https traffic and re-encrypt it using the corporate certificate.
  • This certificate is obviously stored in the system, but Anki doesn’t seem to consider it
  • There seems to be a flag –native-tls for Python that might fix this issue. But when I try to run the uv run command without the launcher, it doesn’t work at all, probably due to some missing Python setup.

Required Fix:
So in short I would say the following fixes would be required:

  1. Use the proxy configuration from the system and/or allow to manually configure a proxy
  2. Use the SSL certificates from the system and/or allow to ignore invalid certificates (which is obviously not ideal)

Thanks a lot

P.S. I cannot say if this problem only occurs on MacOS as this is currently my only machine with a corporate proxy setup. I also use Anki on Windows, Linux and Android, but there I have direct internet access and no issues…

2 Likes

Maybe try running the launcher with UV_NATIVE_TLS=1

EDIT: Sorry, this won’t do anything as the launcher helpfully removes all UV_* env vars beforehand. Opened a pr to get the launcher to set it, which should fix this

3 Likes

I can confirm that it doesn’t work with 25.09.

Hm, you wouldn’t know if the launcher also does something with the HTTP_PROXY / HTTPS_PROXY variables? Hopefully not…

uv should pick those up automatically (Environment variables | uv), it’s just a question of telling it to use the system certstore

Anki installer fails to run after checking for the updates, it shows “ Error: Failed to run (2):”

Probably related to Invalid peer certificate issue with latest version - Anki / Help - Anki Forums