Choosing between a custom CA bundle and --trusted-host for pip installs behind an intercepting proxy

Direct answer

Pip gives precedence to an explicitly supplied --cert / PIP_CERT bundle over the system trust store, and it does not fall back to the system store when the bundle is used.

If you run pip with --cert or PIP_CERT set, pip uses that bundle as the sole trust anchor for TLS verification of the index and package URLs. The system trust store is ignored for that connection. If the bundle does not contain the proxy’s signing CA, the TLS handshake fails and the install aborts. There is no silent fallback to the system store.

--trusted-host disables certificate validation entirely for the named host. It will make the install succeed even with a missing or untrusted proxy CA, but it removes TLS verification for that host.

Confirmed facts vs likely explanation

Confirmed behavior to plan around:

• An explicit certificate bundle supplied via --cert or PIP_CERT is used instead of the system store. The bundle is the trust source for that pip invocation.
• When the bundle is used, pip does not merge it with the system store and does not fall back to the system store on verification failure.
• --trusted-host bypasses verification for the specified host. It is a security reduction, not a trust configuration.

Likely explanation and assumptions:

The precedence is implemented in pip’s use of urllib3/requests where a custom CA file replaces the default certifi/system bundle. This is the expected behavior for modern pip releases. The exact internal handling can vary with the bundled TLS library and platform, so treat the above as the operational assumption until verified in your environment. Behavior prior to recent pip releases may differ.

Steps needed for this case

1. Confirm the proxy CA you need to trust. Export the proxy’s signing certificate chain in PEM format.
2. Create a bundle that contains the proxy CA plus any required intermediates, and test it manually:

openssl s_client -connect pypi.org:443 -CAfile /path/to/bundle.pem -servername pypi.org < /dev/null

Look for verification OK in the output.

1. Use the bundle with pip, not --trusted-host:

pip install --cert /path/to/bundle.pem <package>

Or set the environment variable for the session:

PIP_CERT=/path/to/bundle.pem pip install <package>

1. Verify which trust store pip is using:

pip debug

Check the Certificates section. With PIP_CERT set, pip will report the explicit path.

Avoid --trusted-host unless the proxy is fully trusted and you accept the risk of MITM. If you must use it, scope it to the minimal host and index URL.

One diagnostic that changes the recommendation

Is the proxy’s signing CA already present in the system trust store on the machine running pip? If yes, omitting --cert will work and you can rely on system trust. If no, you must supply a bundle that contains the proxy CA, because pip will not fall back once --cert is provided and will fail if the CA is missing from the bundle.