How to add a custom CA Root certificate to the CA Store used by Python in Windows?
<p>I just installed Python3 from python.org and am having trouble installing packages with <code>pip</code>.  By design, there is a man-in-the-middle packet inspection appliance on the network here that inspects all packets (ssl included) by resigning all ssl connections with its own certificate.  Part of the GPO pushes the custom root certificate into the Windows Keystore.</p>

<p>When using Java, if I need to access any external https sites, I need to manually update the cacerts in the JVM to trust the Self-Signed CA certificate.</p>

<p>How do I accomplish that for python?  Right now, when I try to install packages using <code>pip</code>, understandably, I get wonderful <code>[SSL: CERTIFICATE_VERIFY_FAILED]</code> errors.</p>

<p>I realize I can ignore them using the <code>--trusted-host</code> parameter, but I don't want to do that for every package I'm trying to install.</p>

<p>Is there a way to update the CA Certificate store that python uses?</p>

<p>Run: python -c "import ssl; print(ssl.get_default_verify_paths())" to check the current paths which are used to verify the certificate. Add your companies root certificate to one of those.</p>

<p>The path openssl_capath_env points to the enviroment variable: 'SSL_CERT_DIR'. You need to create an environment variable 'SSL_CERT_DIR' (if it doesn't exists) and point it to a valid folder within your filesystem. In this folder you need to add your certificate and you should be able to use it.</p>

python windows ssl