Use the SSL CA bundle that Requests includes, rather than relying upon the systems CA bundle which is often unavailable, or out of date.