Introduction

When Keras downloads pretrained weights such as ResNet50(weights="imagenet"), it fetches files over HTTPS. An SSL CERTIFICATE_VERIFY_FAILED error means Python could not validate the server certificate chain, so the download was blocked before the model weights arrived.

This is usually an environment problem, not a ResNet50 problem. The common causes are outdated CA certificates, corporate TLS interception, incorrect system time, or a Python environment that is not using a valid certificate store.

The Typical Failing Code

The error often appears from code like this:

from tensorflow.keras.applications import ResNet50

model = ResNet50(weights="imagenet")

The model definition is fine. The failure happens during the underlying HTTP download of the cached weight file.

Start with the Environment, Not Keras

Check these first:

• system date and time are correct
• Python and pip are reasonably current
• certificate bundles on the machine are up to date
• the machine is not behind a proxy that rewrites certificates without the local trust store knowing about it

An incorrect system clock alone can make valid certificates look expired or not yet valid. It is worth checking this before changing any Python code because it is one of the fastest fixes and one of the easiest causes to overlook.

Update Certificate-Related Packages

A common Python-side fix is to update certificate tooling and the CA bundle.

python -m pip install --upgrade pip certifi

Then check where certifi points:

import certifi
print(certifi.where())

This helps confirm that Python can see a certificate bundle at all.

Corporate Proxy and SSL Inspection Cases

In enterprise networks, outbound HTTPS may be intercepted and re-signed by a company certificate authority. If that CA is not trusted by your Python environment, certificate verification fails.

In that case, the right fix is to add the corporate CA to the trust chain used by Python or the OS, according to your environment’s policy. The wrong fix is to disable SSL verification globally.

Avoid Disabling Verification

You may find code snippets online that bypass SSL checks. Do not use those as a normal solution for model downloads. They solve the symptom by removing certificate validation entirely, which weakens the security of the connection.

A secure fix is:

• repair the CA bundle
• correct the clock
• fix proxy configuration
• use an approved internal mirror if your environment requires one

A Practical Workaround When Networking Is Controlled

If the environment is tightly restricted, you can manually place the pretrained weights into the Keras cache directory after downloading them through an approved path. That avoids live download during model initialization.

This is often the most practical solution on locked-down servers with known outbound restrictions.

Common Pitfalls

• Blaming the ResNet50 model code when the real issue is Python or system certificate trust.
• Disabling SSL verification instead of fixing CA trust properly.
• Ignoring system time, which is a surprisingly common cause of certificate failures.
• Testing on a corporate network without realizing a proxy is rewriting certificates.
• Repeating the failed download over and over without checking whether manual cache population is an acceptable fallback.

Summary

• 'SSL CERTIFICATE_VERIFY_FAILED during ResNet50(weights="imagenet") is an HTTPS trust problem, not a model-definition problem.'
• Start by checking system time, certificate bundles, Python environment, and network proxy behavior.
• Updating certifi and related tooling is a common first fix.
• In enterprise environments, corporate CA trust is often the missing piece.
• Avoid disabling SSL verification; repair trust or use a controlled manual download path instead.