Bower strict-ssl global bypass without per-host certificate exceptions

Goal

Configure Bower to trust a self-signed certificate for an internal package registry while preserving strict certificate validation for public registries and Git hosts.

Constraints

The strict-ssl setting in .bowerrc is a global boolean that controls HTTPS certificate validation for all outbound connections. Bower does not support per-host certificate exceptions, a custom CA bundle path, or certificate pinning for specific registries. Setting strict-ssl to false disables validation universally, exposing every registry and Git over HTTPS operation to man-in-the-middle risk. The project is deprecated and unmaintained, so no upstream enhancement to add granular trust controls is expected.

Uncertainty

It is unclear whether environment-level workarounds—such as adding the internal CA to the system trust store, using a local HTTPS proxy that terminates TLS, or shelling out to Git with its own http.sslCAInfo—can reliably isolate the trust decision without modifying Bower itself.

Is there a documented or community-tested approach to scope certificate trust to a single registry in Bower 1.x? Can Git's per-host SSL configuration be leveraged for Git-based dependencies while keeping registry downloads strict? Are there known side effects of injecting a custom CA into the Node.js runtime that Bower inherits?