[Python] How to add a custom CA Root certificate to the CA Store used by pip in Windows?

I just installed Python3 from python.org and am having trouble installing packages with pip. By design, there is a man-in-the-middle packet inspection appliance on the network here that inspects all packets (ssl included) by resigning all ssl connections with its own certificate. Part of the GPO pushes the custom root certificate into the Windows Keystore.

When using Java, if I need to access any external https sites, I need to manually update the cacerts in the JVM to trust the Self-Signed CA certificate.

How do I accomplish that for python? Right now, when I try to install packages using pip, understandably, I get wonderful [SSL: CERTIFICATE_VERIFY_FAILED] errors.

I realize I can ignore them using the --trusted-host parameter, but I don't want to do that for every package I'm trying to install.

Is there a way to update the CA Certificate store that python uses?

Continue reading...