[1.x Bug] uv add dbt-sqlserver fails to build dbt-core-experimental-parser==2.0.0a5: SSL certificate verification failed

[MichelLalancetteNortera]

Is this a new bug in dbt-core?

• I believe this is a new bug in dbt-core
• I have searched the existing issues, and I could not find an existing issue for this bug

Current Behavior

Summary

When attempting to install dbt-sqlserver[mssql] (which transitively pulls in dbt-core -> dbt-core-experimental-parser==2.0.0a5), the build hook fails during the build step when fetching the release .whl from GitHub Releases. This was done on my work laptop. My personal computer works just fine.

The custom build backend (_dbt_sa_build) uses Python's standard urllib to download external assets, which triggers an SSL certificate verification failure:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1082).

dbt_install_debug.txt

Root Cause
The dbt-core-experimental-parser package uses a custom PEP 517 build hook (_dbt_sa_build.build_wheel) that uses standard library urllib.request to dynamically fetch pre-compiled binaries from GitHub (https://github.com/dbt-labs/dbt-core/releases/download/...).

Unlike pip or uv (which bundle certifi or use native system trust stores), standard library urllib relies strictly on OpenSSL's certificate validation, which rejects the redirect target on Windows under Python 3.14 due to missing Authority Key Identifier (AKID) validation checks.

Diagnostic Verification
Running a direct urllib fetch against the target release URL produces the exact same trace:

uv run python -c "import urllib.request; urllib.request.urlopen('[https://github.com/dbt-labs/dbt-core/releases/download/v2.0.0-alpha.5/dbt_core_experimental_parser-2.0.0a5-py3-none-win_amd64.whl](https://github.com/dbt-labs/dbt-core/releases/download/v2.0.0-alpha.5/dbt_core_experimental_parser-2.0.0a5-py3-none-win_amd64.whl)')"

Traceback:

Traceback (most recent call last):
  File "Lib\ssl.py", line 1372, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1082)

urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1082)>

DEBUG Calling _dbt_sa_build.build_wheel("C:\\Users\\user\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpl183iH", {}, None)
DEBUG RuntimeError: failed to download https://github.com/dbt-labs/dbt-core/releases/download/v2.0.0-alpha.5/dbt_core_experimental_parser-2.0.0a5-py3-none-win_amd64.whl: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1082)>
× Failed to build dbt-core-experimental-parser==2.0.0a5

Expected Behavior

Expected Behavior

dbt-core-experimental-parser (and transitively dbt-sqlserver) should install smoothly via standard Python package managers (uv, pip) without failing during the PEP 517 build phase.

Specifically:

• The custom build backend (_dbt_sa_build) should gracefully handle SSL context initialization (e.g., using certifi or fallback SSL contexts) when fetching release assets over HTTPS, rather than relying strictly on unconfigured standard library urllib.
• Pre-built wheel releases should ideally be published directly to PyPI to avoid out-of-band network calls during the build hook.

Steps To Reproduce

1. In a clean directory with Python 3.14, run:

   uv add dbt-sqlserver[mssql]
   

Relevant log output

DEBUG Registry requirement already cached: text-unidecode==1.3
DEBUG Registry requirement already cached: zipp==4.1.0
DEBUG Registry requirement already cached: pycparser==3.0
DEBUG Using request connect timeout of 10s and read timeout of 30s
DEBUG Computed cache info: Timestamp(SystemTime { intervals: 134304084216742132 }), None, None, {}, {"src": Some(Timestamp(Timestamp(SystemTime { intervals: 134304066936194903 })))}. Most recently modified: pyproject.toml
DEBUG Cached revision does not match expected cache info for: test @ file:///C:/Users/user/Documents/test
DEBUG Found fresh response for: https://files.pythonhosted.org/packages/54/bc/d37f24f564cb32b3c13e470e5dfd8555b71c202580f701580ebd7e9cd10d/dbt_core_experimental_parser-2.0.0a5.tar.gz
   Building dbt-core-experimental-parser==2.0.0a5
DEBUG Building: dbt-core-experimental-parser==2.0.0a5
   Building test @ file:///C:/Users/user/Documents/test
DEBUG Building: test @ file:///C:/Users/user/Documents/test
DEBUG Creating build environment for: dbt-core-experimental-parser==2.0.0a5
DEBUG Performing direct build for test @ file:///C:/Users/user/Documents/test
DEBUG Project is contained in cache directory: `C:\Users\user\AppData\Local\uv\cache\sdists-v9\pypi\dbt-core-experimental-parser\2.0.0a5\cTQgk2rjy8sA-nkJ\src`
DEBUG No workspace root found, using project root
DEBUG Using base executable for virtual environment: C:\Users\user\AppData\Roaming\uv\python\cpython-3.14-windows-x86_64-none\python.exe
DEBUG Wheel excludes: ["__pycache__", "*.pyc", "*.pyo"]
DEBUG Writing wheel at C:\Users\user\AppData\Local\uv\cache\builds-v0\.tmpwFes8X\test-0.1.0-py3-none-any.whl
DEBUG Adding pth file to C:\Users\user\AppData\Local\uv\cache\builds-v0\.tmpwFes8X\test-0.1.0-py3-none-any.whl
DEBUG Source root: src
DEBUG Module path: test
DEBUG Adding metadata files to: C:\Users\user\AppData\Local\uv\cache\builds-v0\.tmpwFes8X\test-0.1.0-py3-none-any.whl
DEBUG Resolving build requirements
DEBUG Solving with installed Python version: 3.14.6
DEBUG Solving with target Python version: >=3.14.6
DEBUG Built `test @ file:///C:/Users/user/Documents/test` into `test-0.1.0-py3-none-any.whl`
DEBUG Adding direct dependency: packaging>=24
      Built test @ file:///C:/Users/user/Documents/test
DEBUG Found fresh response for: https://pypi.org/simple/packaging/
DEBUG Searching for a compatible version of packaging (>=24)
DEBUG Selecting: packaging==26.3 [compatible] (packaging-26.3-py3-none-any.whl)
DEBUG Found fresh response for: https://files.pythonhosted.org/packages/63/34/ba1c580383c9eada3711951fef0795c80b829a078d72188184bcab9dd527/packaging-26.3-py3-none-any.whl.metadata
DEBUG Tried 1 versions: packaging 1
DEBUG marker environment resolution took 0.003s
DEBUG Installing in packaging==26.3 in C:\Users\user\AppData\Local\uv\cache\builds-v0\.tmp0QoOFq
DEBUG Registry requirement already cached: packaging==26.3
DEBUG Installing build requirement: packaging==26.3
DEBUG Creating PEP 517 build environment
DEBUG Calling `_dbt_sa_build.get_requires_for_build_wheel()`
DEBUG Calling `_dbt_sa_build.build_wheel("C:\\Users\\user\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpl183iH", {}, None)`
DEBUG Traceback (most recent call last):
DEBUG   File "<string>", line 11, in <module>
DEBUG     wheel_filename = backend.build_wheel("C:\\Users\\user\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpl183iH", {}, None)
DEBUG   File "C:\Users\user\AppData\Local\uv\cache\sdists-v9\pypi\dbt-core-experimental-parser\2.0.0a5\cTQgk2rjy8sA-nkJ\src\_dbt_sa_build\__init__.py", line 66, in build_wheel
DEBUG     data = _fetch(url)
DEBUG   File "C:\Users\user\AppData\Local\uv\cache\sdists-v9\pypi\dbt-core-experimental-parser\2.0.0a5\cTQgk2rjy8sA-nkJ\src\_dbt_sa_build\__init__.py", line 59, in _fetch
DEBUG     raise RuntimeError(f"failed to download {url}: {last}")
DEBUG RuntimeError: failed to download https://github.com/dbt-labs/dbt-core/releases/download/v2.0.0-alpha.5/dbt_core_experimental_parser-2.0.0a5-py3-none-win_amd64.whl: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1082)>
DEBUG Reverting changes to `pyproject.toml`
DEBUG Reverting changes to `uv.lock`
  × Failed to build `dbt-core-experimental-parser==2.0.0a5`
  ├─▶ The build backend returned an error
  ╰─▶ Call to `_dbt_sa_build.build_wheel` failed (exit code: 1)

      [stderr]
      Traceback (most recent call last):
        File "<string>", line 11, in <module>
          wheel_filename = backend.build_wheel("C:\\Users\\user\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpl183iH", {}, None)
        File
      "C:\Users\user\AppData\Local\uv\cache\sdists-v9\pypi\dbt-core-experimental-parser\2.0.0a5\cTQgk2rjy8sA-nkJ\src\_dbt_sa_build\__init__.py",
      line 66, in build_wheel
          data = _fetch(url)
        File
      "C:\Users\user\AppData\Local\uv\cache\sdists-v9\pypi\dbt-core-experimental-parser\2.0.0a5\cTQgk2rjy8sA-nkJ\src\_dbt_sa_build\__init__.py",
      line 59, in _fetch
          raise RuntimeError(f"failed to download {url}: {last}")
      RuntimeError: failed to download
      https://github.com/dbt-labs/dbt-core/releases/download/v2.0.0-alpha.5/dbt_core_experimental_parser-2.0.0a5-py3-none-win_amd64.whl:
      <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1082)>


hint: `dbt-core-experimental-parser` (v2.0.0a5) was included because `test` (v0.1.0) depends on `dbt-sqlserver` (v1.11.0) which depends on `dbt-core` (v1.12.0) which depends on `dbt-core-experimental-parser`
hint: Build failures usually indicate a problem with the package or the build environment
hint: If you want to add the package regardless of the failed resolution, provide the `--frozen` flag to skip locking and syncing

Environment

- OS: Windows 11 (`Windows-11-10.0.26200-SP0`)
- Python: CPython 3.14.6
- dbt: 1.12.0
- OpenSSL Version: OpenSSL 3.5.7 9 Jun 2026
- CA File Path: C:\Program Files\Common Files\SSL\cert.pem

Which database adapter are you using with dbt?

other (mention it in "Additional Context")

Additional Context

No response

[MichelLalancetteNortera]

For more information, I was able to install the wheel with uv, but I had to do it manually.

uv add .\dbt_core_experimental_parser-2.0.0a5-py3-none-win_amd64.whl

pyproject.toml

dependencies = [
    "dbt-core-experimental-parser",
    "dbt-sqlserver[mssql]>=1.11.0",
]

[tool.uv.sources]
dbt-core-experimental-parser = { path = "dbt_core_experimental_parser-2.0.0a5-py3-none-win_amd64.whl" }

[MrLint]

I have the same issue, I am reasonably sure this is due to the MITM packet sniffing of my organization. Adding github.com as a trusted host to pip.ini doesn't fix the issue; which I guess is because the install script is trying to hit the url directly? The WHL can be picked up separately via the browser, and the winget install of dbt-core works (https://winstall.app/apps/dbtLabs.dbt-core) to drops the dbt.exe. So perhaps a way to 'pre-install' the exe inside the WHL, and a way to bypass or check if the user has already dropped it in?

[kggx]

I have the same issue, I am reasonably sure this is due to the MITM packet sniffing of my organization.

I dont beleive this is due to the MITM. I have the issue on my non-work Linux based machine but not on org-controlled and work-machine which has network sniffing enabled.

Contrary to OP my Windows based build works but not on Linux.

Windows 11

PS C:\Users\kilian.braun\repositories\REPOSITORY_NAME> uv sync
Using CPython 3.14.4
Removed virtual environment at: .venv
Creating virtual environment at: .venv
Resolved 94 packages in 2ms
      Built dbt-core-experimental-parser==2.0.0a5
Prepared 24 packages in 40.00s
Installed 93 packages in 1.58s
 + agate==1.9.1
 + annotated-types==0.8.0
 + attrs==26.1.0
 + babel==2.18.0
 + certifi==2026.7.22
 + cffi==2.1.1
 + chardet==7.5.1
 + charset-normalizer==3.4.9
 + click==8.3.3
 + colorama==0.4.6
 + cryptography==50.0.0
 + daff==1.4.2
 + databricks-sdk==0.117.0
 + databricks-sql-connector==4.3.0
 + dbt-adapters==1.24.5
 + dbt-common==1.37.5
 + dbt-core==1.12.0
 + dbt-core-experimental-parser==2.0.0a5
 + dbt-databricks==1.12.3
 + dbt-extractor==0.6.0
 + dbt-protos==1.0.541
 + dbt-spark==1.10.3
 + deepdiff==8.6.2
 + diff-cover==10.4.1
 + et-xmlfile==2.0.0
 + google-auth==2.56.3
 + idna==3.18
 + importlib-metadata==9.0.0
 + isodate==0.7.2
 + jinja2==3.1.6
 + jinja2-simple-tags==0.6.1
 + jsonschema==4.26.0
 + jsonschema-specifications==2025.9.1
 + leather==0.4.1
 + lz4==4.4.5
 + markupsafe==3.0.3
 + mashumaro==3.17
 + metricflow==0.211.0
 + more-itertools==10.8.0
 + msgpack==1.2.1
 + networkx==3.6.1
 + numpy==2.5.1
 + oauthlib==3.3.1
 + openpyxl==3.1.5
 + orderly-set==5.5.0
 + packaging==25.0
 + pandas==3.0.5
 + parsedatetime==2.6
 + pathspec==1.0.4
 + platformdirs==4.11.0
 + pluggy==1.6.0
 + prettier==0.0.7
 + protobuf==6.33.6
 + pyarrow==25.0.0
 + pyasn1==0.6.4
 + pyasn1-modules==0.4.2
 + pybreaker==1.4.1
 + pycparser==3.0
 + pydantic==2.12.5
 + pydantic-core==2.41.5
 + pygments==2.20.0
 + pyjwt==2.13.0
 + python-dateutil==2.9.0.post0
 + python-dotenv==1.2.2
 + python-slugify==8.0.4
 + pytimeparse==1.1.8
 + pytz==2026.3.post1
 + pyyaml==6.0.3
 + rapidfuzz==3.14.5
 + referencing==0.37.0
 + regex==2026.7.19
 + requests==2.34.2
 + rpds-py==2026.6.3
 + ruff==0.16.1
 + six==1.17.0
 + snowplow-tracker==1.1.0
 + sqlfluff==4.2.2
 + sqlfluff-templater-dbt==4.2.2
 + sqlglot==30.15.0
 + sqlparams==6.2.0
 + sqlparse==0.5.5
 + tabulate==0.10.0
 + tblib==3.2.2
 + text-unidecode==1.3
 + thrift==0.22.0
 + tqdm==4.70.0
 + ty==0.0.69
 + typing-extensions==4.16.0
 + typing-inspection==0.4.2
 + tzdata==2026.3
 + urllib3==2.7.0
 + yamllint==1.38.0
 + zipp==4.1.0

Nixos

❯ uv sync
Resolved 94 packages in 0.84ms
  × Failed to build `dbt-core-experimental-parser==2.0.0a5`
  ├─▶ The build backend returned an error
  ╰─▶ Call to `_dbt_sa_build.build_wheel` failed (exit status: 1)

      [stderr]
      Traceback (most recent call last):
        File "<string>", line 11, in <module>
          wheel_filename = backend.build_wheel(__import__("os").fsdecode(b"/home/kilian/.cache/uv/builds-v0/.tmpgomfBm"), {}, None)
        File "/home/kilian/.cache/uv/sdists-v9/pypi/dbt-core-experimental-parser/2.0.0a5/RxU_6SfTcT0smRbG/src/_dbt_sa_build/__init__.py", line 66, in build_wheel
          data = _fetch(url)
        File "/home/kilian/.cache/uv/sdists-v9/pypi/dbt-core-experimental-parser/2.0.0a5/RxU_6SfTcT0smRbG/src/_dbt_sa_build/__init__.py", line 59, in _fetch
          raise RuntimeError(f"failed to download {url}: {last}")
      RuntimeError: failed to download https://github.com/dbt-labs/dbt-core/releases/download/v2.0.0-alpha.5/dbt_core_experimental_parser-2.0.0a5-py3-none-manylinux_2_28_x86_64.whl:
      <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1082)>


hint: `dbt-core-experimental-parser` (v2.0.0a5) was included because `REPOSITORY_NAME` (v0.2.0) depends on `dbt-core` (v1.12.0) which depends on `dbt-core-experimental-parser`
hint: Build failures usually indicate a problem with the package or the build environment% 

[MichelLalancetteNortera]

Never mind that... it must have been cached somewhere because the issue remains.

[talsaleh-ofx]

I have the same issue but managed to pin to "dbt-core-experimental-parser==2.0.0a4" in my pyproject.toml.
Can this be fixed pls