Certificate Authority Trust Setup Guide

What is a "CA"?

A Certificate Authority (CA) is a trusted organization that issues and signs digital certificates. When you connect over HTTPS, your client verifies that the server's certificate chains back to one of the CAs in its trust store.

Why you see SSL errors

Your corporate proxy (zsproxy.gsk.com) intercepts HTTPS traffic and re-signs certificates with its own internal CA. Because that CA isn't in Python's default bundle, SSL verification fails.

How to fix it

By appending or installing your proxy's CA certificate into the bundle or OS trust store, you're telling your client to also trust certificates signed by that internal CA. When the proxy presents its re-signed cert, your application will successfully verify the chain and establish a secure connection.

Technical walkthrough

1. Local machines (developer laptops)

1. Locate the default bundle

   python -c "import certifi; print(certifi.where())"
   

   Example output:

   /Users/you/.../certifi/cacert.pem
   C:\Users\you\...\certifi\cacert.pem
   

2. Create a combined bundle

   • macOS / Linux

     cp /path/to/cacert.pem full_bundle.pem
     cat zsproxy.gsk.com.crt >> full_bundle.pem
     

   • Windows PowerShell

     Get-Content C:\path\to\cacert.pem, C:\path\to\zsproxy.gsk.com.crt |
       Set-Content C:\path\to\full_bundle.pem
     

3. Set the environment variable

   • macOS / Linux (Bash)

     export REQUESTS_CA_BUNDLE="/full/path/to/full_bundle.pem"
     

   • Windows (PowerShell)

     $Env:REQUESTS_CA_BUNDLE = "C:\full\path\to\full_bundle.pem"
     

4. Verify in code

   import os
   import requests
   
   # os.environ[...] must already be set—either via shell or in-code before importing requests
   response = requests.get("https://gsk.wandb.io")
   print(response.status_code)  # should be 200
   

2. Cloud functions & containers

Note: You cannot modify the host OS store. You must bundle your CA file and set the environment variable in your deployment configuration.

1. Include the combined bundle

   • In your project, create a certs/ folder
   • Locally generate certs/cacert.pem by concatenating:

     cp "$(python -c 'import certifi; print(certifi.where())')" certs/cacert.pem
     cat zsproxy.gsk.com.crt >> certs/cacert.pem
     

2. Set the environment variable

   • Azure Functions (Portal)

     1. Go to Configuration → Application settings
     2. Click New application setting
     3. Name: REQUESTS_CA_BUNDLE Value: /home/site/wwwroot/certs/cacert.pem
     4. Save and restart your Function App

   • Docker containers

     # After copying certs/ into the image
     ENV REQUESTS_CA_BUNDLE=/app/certs/cacert.pem
     

     docker run \
       -e REQUESTS_CA_BUNDLE=/app/certs/cacert.pem \
       my-image
     

   • Kubernetes Pod

     apiVersion: v1
     kind: Pod
     metadata:
       name: my-app
     spec:
       containers:
       - name: app
         image: my-image
         env:
         - name: REQUESTS_CA_BUNDLE
           value: "/app/certs/cacert.pem"
         volumeMounts:
         - name: certs
           mountPath: /app/certs
       volumes:
       - name: certs
         configMap:
           name: my-cert-configmap
     

3. Optional in-code override

   import os
   os.environ["REQUESTS_CA_BUNDLE"] = os.path.join(
       os.path.dirname(__file__), "certs", "cacert.pem"
   )
   import requests
   

3. Full Azure VMs (Windows & Linux)

Note: You can install the CA into the OS trust store so all applications automatically trust it.

Windows VM 1. Run certlm.msc (Local Machine → Trusted Root Certification Authorities) 2. Right-click Certificates → All Tasks → Import… → select zsproxy.gsk.com.crt → Finish 3. (Python)

• To use the Windows store directly with requests, install:

  pip install certifi-win32
  

• Or continue to use REQUESTS_CA_BUNDLE pointing at a PEM as in the "Local machines" section

Linux VM 1. Copy your certificate:

sudo cp zsproxy.gsk.com.crt /usr/local/share/ca-certificates/

2. Update the store:

   sudo update-ca-certificates        # Debian/Ubuntu
   sudo update-ca-trust extract       # RHEL/CentOS
   

3. (Python)

   • Many Linux Python builds will then use the system OpenSSL bundle automatically
   • If not, set REQUESTS_CA_BUNDLE as above

Outcome

Whether on your laptop, in serverless code, inside a container, or running on a VM, trusting your proxy's CA ensures Python's requests and other TLS-based clients will validate the man-in-the-middle certificates and maintain a secure connection to your Weights & Biases instance.