pypa/pip — pull request #1741 by djs (2014-04-22 00:48:44+00:00)
Title: Add option --no-ssl-verify to skip ssl cert verification

This change tries to address issue #990 among likely others but providing a simple, practical solution.

There are times, particularly in "enterprise" environments where the nobility of forcing SSL verification results in decreased security. As an example, my actual reason for wanting this feature resulted from the following:
1. Corporate firewall intercepted *.fastly.net wildcard CDN ssl certificate when pypi switched over to forcing https. pip 1.4.x refused to download because of a chain verification error, as expected.
2. I deployed pip 1.2.1 to all my machines because this was easier than dealing with deploying the cert chain everywhere. I planned to deploy it eventually.
3. Today I wanted to run the latest pip and decided to use my working (but undeployed) cert chain solution. When it didn't work, I manually debugged it and discovered that the corporate firewall was no longer intercepting the ssl connection.
4. I discovered that openssl 0.9.8 does not like the *.fastly.net wildcard cert that is behind pypi. This version of openssl is all that is available in all existing versions of SUSE Enterprise Linux 11.

So, now my options seem to be limited to sticking with pip 1.2.1 forever or getting an option to ignore certificate errors. I think adding this option is a better solution.