diff --git a/cekit/tools.py b/cekit/tools.py
index a53b9ec..9aaba1e 100644
--- a/cekit/tools.py
+++ b/cekit/tools.py
@@ -352,6 +352,14 @@ class DependencyHandler(object):
         self._handle_dependencies(
             DependencyHandler.EXTERNAL_CORE_DEPENDENCIES)
 
+        try:
+            import certifi  # pylint: disable=unused-import
+            LOGGER.warning(("The certifi library (https://certifi.io/) was found, depending on the operating " +
+                            "system configuration this may result in certificate validation issues"))
+            LOGGER.warning("Certificate Authority (CA) bundle in use: '{}'".format(certifi.where()))
+        except ImportError:
+            pass
+
     def handle(self, o):
         """
         Handles dependencies from selected object. If the object has 'dependencies' method,

Try to detect certifi package installs and warn user if custom installation is found
The certifi library when installed locally provides a custom certificate store that can override the globally provided setting. We should try to find if certifi is installed and if yes, we should warn the user that certificate-related issues may appear.

We probably should do this only when `--redhat` switch is used.
diff --git a/tests/test_unit_tools.py b/tests/test_unit_tools.py
index 9ac8561..fba8b71 100644
--- a/tests/test_unit_tools.py
+++ b/tests/test_unit_tools.py
@@ -1,6 +1,7 @@
 import logging
 import pytest
 import subprocess
+import sys
 import yaml
 
 from contextlib import contextmanager
@@ -550,3 +551,25 @@ def test_dependency_handler_check_for_executable_with_executable_fail_with_packa
 
         with pytest.raises(CekitError, match=r"^CEKit dependency: 'xyz' was not found, please provide the 'xyz-aaa' executable. To satisfy this requirement you can install the 'package-xyz' package.$"):
             handler._check_for_executable('xyz', 'xyz-aaa', 'package-xyz')
+
+
+def test_handle_core_dependencies_no_certifi(mocker, caplog):
+    sys.modules['certifi'] = None
+
+    with mocked_dependency_handler(mocker) as handler:
+        handler.handle_core_dependencies()
+
+    assert "The certifi library (https://certifi.io/) was found, depending on the operating system configuration this may result in certificate validation issues" not in caplog.text
+
+
+def test_handle_core_dependencies_with_certifi(mocker, caplog):
+    mock_certifi = mocker.Mock()
+    mock_certifi.where.return_value = 'a/path.pem'
+
+    sys.modules['certifi'] = mock_certifi
+
+    with mocked_dependency_handler(mocker) as handler:
+        handler.handle_core_dependencies()
+
+    assert "The certifi library (https://certifi.io/) was found, depending on the operating system configuration this may result in certificate validation issues" in caplog.text
+    assert "Certificate Authority (CA) bundle in use: 'a/path.pem'" in caplog.text

pip install -e .
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-xdist pytest-mock pytest-asyncio
apt-get update apt-get install -y gcc
3.9
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
-e git+https://github.com/cekit/cekit.git@c145339f0881a46cb94e1289d8f733f7c6604320#egg=cekit
click==8.1.8
colorlog==6.9.0
coverage==7.8.0
docopt==0.6.2
exceptiongroup==1.2.2
execnet==2.1.1
iniconfig==2.1.0
Jinja2==3.1.6
MarkupSafe==3.0.2
packaging==24.2
pluggy==1.5.0
pykwalify==1.8.0
pytest==8.3.5
pytest-asyncio==0.26.0
pytest-cov==6.0.0
pytest-mock==3.14.0
pytest-xdist==3.6.1
python-dateutil==2.9.0.post0
PyYAML==6.0.2
ruamel.yaml==0.18.10
ruamel.yaml.clib==0.2.12
six==1.17.0
tomli==2.2.1
typing_extensions==4.13.0

name: cekit
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=25.0=py39h06a4308_0
  - python=3.9.21=he870216_1
  - readline=8.2=h5eee18b_0
  - setuptools=75.8.0=py39h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tzdata=2025a=h04d1e81_0
  - wheel=0.45.1=py39h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - click==8.1.8
      - colorlog==6.9.0
      - coverage==7.8.0
      - docopt==0.6.2
      - exceptiongroup==1.2.2
      - execnet==2.1.1
      - iniconfig==2.1.0
      - jinja2==3.1.6
      - markupsafe==3.0.2
      - packaging==24.2
      - pluggy==1.5.0
      - pykwalify==1.8.0
      - pytest==8.3.5
      - pytest-asyncio==0.26.0
      - pytest-cov==6.0.0
      - pytest-mock==3.14.0
      - pytest-xdist==3.6.1
      - python-dateutil==2.9.0.post0
      - pyyaml==6.0.2
      - ruamel-yaml==0.18.10
      - ruamel-yaml-clib==0.2.12
      - six==1.17.0
      - tomli==2.2.1
      - typing-extensions==4.13.0
prefix: /opt/conda/envs/cekit

tests/test_unit_tools.py::test_handle_core_dependencies_with_certifi
tests/test_unit_tools.py::test_dependency_handler_handle_dependencies_with_library_only
tests/test_unit_tools.py::test_merging_description_image tests/test_unit_tools.py::test_merging_description_modules tests/test_unit_tools.py::test_merging_description_override tests/test_unit_tools.py::test_merging_plain_descriptors tests/test_unit_tools.py::test_merging_emdedded_descriptors tests/test_unit_tools.py::test_merging_plain_lists tests/test_unit_tools.py::test_merging_plain_list_of_list tests/test_unit_tools.py::test_merging_list_of_descriptors tests/test_unit_tools.py::test_merge_run_cmd tests/test_unit_tools.py::test_get_brew_url tests/test_unit_tools.py::test_get_brew_url_when_build_was_removed tests/test_unit_tools.py::test_get_brew_url_no_kerberos tests/test_unit_tools.py::test_get_brew_url_with_artifact_containing_dot tests/test_unit_tools.py::test_dependency_handler_init_on_unknown_env_with_os_release_file tests/test_unit_tools.py::test_dependency_handler_on_rhel_7 tests/test_unit_tools.py::test_dependency_handler_on_rhel_8 tests/test_unit_tools.py::test_dependency_handler_init_on_known_env tests/test_unit_tools.py::test_dependency_handler_init_on_unknown_env_without_os_release_file tests/test_unit_tools.py::test_dependency_handler_handle_dependencies_doesnt_fail_without_deps tests/test_unit_tools.py::test_dependency_handler_handle_dependencies_with_executable_only tests/test_unit_tools.py::test_dependency_handler_handle_dependencies_with_executable_only_failed tests/test_unit_tools.py::test_dependency_handler_handle_dependencies_with_executable_and_package_on_known_platform tests/test_unit_tools.py::test_dependency_handler_handle_dependencies_with_platform_specific_package tests/test_unit_tools.py::test_dependency_handler_check_for_executable_with_executable_only tests/test_unit_tools.py::test_dependency_handler_check_for_executable_with_executable_fail tests/test_unit_tools.py::test_dependency_handler_check_for_executable_with_executable_fail_with_package tests/test_unit_tools.py::test_handle_core_dependencies_no_certifi
cekit/tools.py
cekit/tools.py