We installed the our root cert on the client, and the https connection works for curl.
curl
But if we try to use pip, it fails:
pip
My solution is downloading cacert.pem from http://curl.haxx.se/ca/cacert.pem and add the path for cacert.pem to ~/.pip/pip.conf as guettli suggested
cacert.pem
~/.pip/pip.conf
[global] cert = /path/to/cacert.pem