(For Linux systems)
Correct me if I’m wrong, but can’t this be overridden with PIP_CERT env vars, the --cert option to pip, or in the configuration file for pip by defining this? (at least on Linux systems)
[global]
cert = /etc/ssl/certs/ca-certificates.crt
From what I can tell this would override the certificate bundle as well.
(For what it’s worth, I fully agree with switching to using truststore by default - modified versions of pip and certifi do this in Ubuntu and Debian distributions when installed via apt to enforce the use of the system CA certificates store - though that’s not as relevant to Python and pip itself, it makes more sense to at least note it)