Codecov uploader TLS validation with a private CA: no documented CA bundle option

Short answer

There is no uploader-specific flag or codecov.yml key for a custom CA bundle, but you most likely don't need one. The Codecov Bash uploader is a wrapper around curl, and curl honors the standard OpenSSL/cURL environment variables SSL_CERT_FILE and CURL_CA_BUNDLE. Setting one of those scoped to the upload step gives you full certificate validation against your private CA without modifying the system trust store and without resorting to --no-verify.

What is likely vs. confirmed

Confirmed by inspection: the Bash uploader shells out to curl for the actual upload, so its TLS behavior is curl's TLS behavior. You can verify this on your runner by reading the uploader script (curl -s https://codecov.io/bash | less) and confirming the upload commands.

Likely, but verify on your stack: that your runner's curl is linked against OpenSSL (which reads SSL_CERT_FILE) or a build that reads CURL_CA_BUNDLE. Most Linux CI images qualify, but check with curl --version — the SSL backend is printed on the first line (e.g., OpenSSL, GnuTLS, Secure Transport). Secure Transport (macOS) builds ignore these variables.

Not applicable: REQUESTS_CA_BUNDLE is specific to Python's requests library. The Bash uploader ignores it. It would only matter if you were uploading via a Python-based tool instead.

Recommended setup

# CI step, scoped to this job only
export SSL_CERT_FILE=/path/to/corporate-ca-bundle.pem
# Optionally also, harmless if redundant:
export CURL_CA_BUNDLE="$SSL_CERT_FILE"

bash <(curl -s https://codecov.io/bash) -t "$CODECOV_TOKEN" -f coverage.xml

The bundle file should contain your corporate CA's certificate (PEM), or a chain bundle if your proxy uses an intermediate. Keep it in the repo or fetch it from a trusted internal location during the job.

Verify before wiring it into CI

# 1. Confirm curl's TLS backend
curl --version

# 2. Reproduce the failure and the fix outside the uploader
curl -v https://codecov.io/ -o /dev/null
SSL_CERT_FILE=/path/to/corporate-ca-bundle.pem curl -v https://codecov.io/ -o /dev/null

The second command should show a successful handshake (SSL certificate verify ok). If it works there, the same variable will work for the uploader, since it inherits the environment.

Caveats

• If you upload via the Codecov GitHub Action or another wrapper rather than the Bash uploader directly, confirm the wrapper passes environment variables through to the underlying process — some actions run in containers with their own environment.
• If the uploader runs inside a Docker container, the CA file must be mounted into the container and the variable set inside it.
• Avoid --no-verify: it disables validation entirely and exposes the upload to man-in-the-middle interception, which is exactly what your TLS-inspecting proxy makes easier.

One detail that would change this recommendation: which uploader you're actually invoking (Bash uploader version, the newer Codecov CLI, or a CI action). The newer CLI is a compiled binary rather than a curl wrapper, so if that's what you use, verify its env-var handling separately before relying on the above.