pip install fails with CERTIFICATE_VERIFY_FAILED: self-signed certificate in certificate chain

Problem

pip install <package> in the PyCharm terminal fails for every package. pip retries five times and gives up:

WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1000)'))': /simple/<package>/
Could not fetch URL https://pypi.org/simple/<package>/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/<package>/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1000)'))) - skipping
ERROR: Could not find a version that satisfies the requirement <package> (from versions: none)
ERROR: No matching distribution found for <package>

The same command fails the same way in a terminal opened outside PyCharm (Command Prompt, PowerShell, Anaconda Prompt). A browser opens https://pypi.org without a warning. The setup is a company network, often Windows with a conda or venv interpreter.

Cause

A device on the company network replaces the pypi.org certificate with a certificate signed by the company's own root certificate. Typical devices are Zscaler, Fortinet, Netskope or a similar TLS-inspecting proxy or firewall. The operating system and the browsers trust that root certificate because the IT department installed it. pip checks certificates against its own bundle of root certificates (certifi). That bundle does not contain the company root, so the chain ends in a root that pip does not know. OpenSSL reports that as self-signed certificate in certificate chain.

PyCharm is not involved. The terminal in PyCharm is a regular shell, and pip runs as a separate process with its own certificate list. The IDE trust store covers the IDE's own connections only. The scope section in How to troubleshoot "Untrusted Server Certificate Warning" lists the processes that read the IDE trust store.

Resolution

1. Get the company root certificate from the IT department as a .pem or .crt file in Base64 (PEM) format.
2. Tell pip to trust that file. The setting is stored in the pip configuration file and applies to later pip runs:

   pip config set global.cert C:\path\to\company-root.pem
   

   For a single run, pip install --cert C:\path\to\company-root.pem <package> does the same.
3. Run pip install <package> again.

pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org <package> also completes the install. That option skips the certificate check for those two hosts and removes the protection that the check gives. The root certificate is the better fix.

The pip documentation on HTTPS certificates describes the --cert option and the certificate sources pip uses.