SSLCertVerificationError on pypi.org: Which CA Bundle Does pip Actually Trust?

When pip connects to pypi.org over HTTPS, it validates the server's TLS certificate against a trusted CA bundle. If that chain cannot be established, the client aborts with SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate. The failure is well documented, yet the exact trust store pip selects in a given environment is often ambiguous.

On systems where OpenSSL, the certifi package, and environment variables such as SSL_CERT_FILE or SSL_CERT_DIR are all present, it is unclear which source pip treats as authoritative. A virtual environment may bundle its own certifi wheel while the host OpenSSL library points to a different system store, and an override variable can silently redirect validation to an unexpected file. The resulting behavior depends on the Python build, the pip version, and the platform's certificate layout, making it difficult to predict which bundle is active without inspecting the runtime.

Which CA source does pip prioritize when multiple are available, and how can an operator determine the effective trust store without modifying the installation? Does the presence of a bundled certifi always shadow the system OpenSSL defaults, or do environment variables override both? What is the expected precedence order across CPython, pip, and OpenSSL when validating certificates for PyPI?