Resolve AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

Problem Statement

When working with Python libraries that depend on OpenSSL (like google-api-python-client or oauth2client), you may encounter this error:
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
The error typically occurs during imports, breaking your application. Common scenarios include:

• After reinstalling or updating Python
• When using Google APIs (from apiclient.discovery import build)
• After environment changes or system updates
• When pip itself becomes unusable due to OpenSSL issues

Root Cause

The error originates from an incompatibility between the pyOpenSSL package and your Python environment. Versions <19.1.0 contain a deprecated attribute (X509_V_FLAG_CB_ISSUER_CHECK) removed in newer OpenSSL libraries.

Recommended Solutions

1. Upgrade pyOpenSSL (Standard Fix)

Update pyOpenSSL to the latest compatible version:

pip install --upgrade pyOpenSSL

For Python 3 environments:

pip3 install --upgrade pyOpenSSL

If the previous command fails, reinstall cryptography dependencies:

pip install --force-reinstall cryptography pyOpenSSL

2. Reinstall pip and Upgrade pyOpenSSL

Use this if pip is broken or the standard upgrade fails:

Linux/MacOS

python3 -m pip uninstall pip
wget https://bootstrap.pypa.io/get-pip.py
python3 get-pip.py
pip install --upgrade pyOpenSSL

Windows

python -m pip uninstall pip
curl -O https://bootstrap.pypa.io/get-pip.py
python get-pip.py
pip install --upgrade pyOpenSSL

3. Manual Removal and Reinstallation

If dependency conflicts persist, manually remove the problematic package:

DANGER

This permanently deletes files. Use only if previous solutions fail.

::: code-group-item Linux/Global

bash

sudo rm -rf /usr/lib/python3/dist-packages/OpenSSL
pip3 install --upgrade pyOpenSSL

::: ::: code-group-item User/venv

bash

rm -rf ~/.local/lib/python3.*/site-packages/OpenSSL
pip install --user --upgrade pyOpenSSL

::: ::: code-group-item Windows

batch

# Find your Python path with:
python -c "import site; print(site.getsitepackages())"

Then delete the detected OpenSSL folder manually :::

4. Install a Specific pyOpenSSL Version

If the latest version causes issues, try a known compatible version:

pip install pyOpenSSL==22.0.0

5. System Package Manager (Ubuntu/Debian)

For system-managed Python environments:

sudo apt update
sudo apt install --reinstall python3-openssl

Complete Error Traceback Example

File "app.py", line 1, in <module>
  from apiclient.discovery import build
File "site-packages/apiclient/__init__.py", line 3, in <module>
  ...
File "site-packages/OpenSSL/crypto.py", line 1537, in X509StoreFlags
  CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

Solution Comparison Table

Method	Use Case	Risk Level
Upgrade pyOpenSSL	First troubleshooting step	Low
Reinstall pip	Broken pip functionality	Medium
Manual Removal	Stubborn installation conflicts	High
Specific Version Installation	Latest version incompatibilities	Low
System Package Manager	System-managed Python (Debian/Ubuntu)	Low

Preventing Future Issues

• Isolate projects using virtual environments (venv or conda)
• Pin dependencies in requirements.txt:

  pyOpenSSL==23.2.0
  cryptography==41.0.7

• Update packages regularly:

  pip list --outdated  # Check outdated packages
  pip install --upgrade `pip list --outdated | grep -v '^\-e' | cut -d = -f 1`

Pro Tip

After applying fixes, verify with:

python -c "from OpenSSL import crypto; print(crypto.__version__)"

This confirms pyOpenSSL imports correctly.

Conclusion

The X509_V_FLAG_CB_ISSUER_CHECK error indicates an outdated pyOpenSSL installation. Start with upgrading pyOpenSSL (pip install --upgrade pyOpenSSL). If that fails, progress through reinstalling pip, manual cleanup, or version-specific installations. For system-managed Python, use your OS package manager. Always test in virtual environments to avoid system-wide conflicts.