# Avoiding compromised certificates in pip

**URL:** <https://discuss.python.org/t/avoiding-compromised-certificates-in-pip/109602>\
**Category:** Packaging\
**Created:** [October 21, 2026, 6:39pm UTC](https://discuss.python.org/t/avoiding-compromised-certificates-in-pip/109602 "2026-10-21T18:39:43Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![teward](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/teward/32/38234_2.png) [@teward](https://discuss.python.org/u/teward)\
**Post date:** [October 22, 2026, 2:02pm UTC](https://discuss.python.org/t/avoiding-compromised-certificates-in-pip/109602/6 "2026-10-22T14:02:41Z")

</div>

**(For Linux systems)**

Correct me if I’m wrong, but can’t this be overridden with `PIP_CERT` env vars, the `--cert` option to `pip`, or in the configuration file for `pip` by defining this? (at least on Linux systems)

```plaintext
[global]
cert = /etc/ssl/certs/ca-certificates.crt

```

From what I can tell this would override the certificate bundle as well.

(For what it’s worth, I fully agree with switching to using `truststore` by default - modified versions of `pip` and `certifi` do this in Ubuntu and Debian distributions when installed via `apt` to enforce the use of the system CA certificates store - though that’s not as relevant to Python and `pip` itself, it makes more sense to at least note it)

---

_[View the full topic](https://discuss.python.org/t/avoiding-compromised-certificates-in-pip/109602)._