diff --git a/winrm/transport.py b/winrm/transport.py
index 81e8826..430c761 100644
--- a/winrm/transport.py
+++ b/winrm/transport.py
@@ -147,19 +147,21 @@ class Transport(object):
     def build_session(self):
         session = requests.Session()
 
-        session.verify = self.server_cert_validation == 'validate'
-        if session.verify and self.ca_trust_path:
-                session.verify = self.ca_trust_path
-
-        # configure proxies from HTTP/HTTPS_PROXY envvars
+        # allow some settings to be merged from env
         session.trust_env = True
         settings = session.merge_environment_settings(url=self.endpoint, proxies={}, stream=None,
                                                       verify=None, cert=None)
 
-        # we're only applying proxies and/or verify from env, other settings are ignored
+        # get proxy settings from env
+        # FUTURE: allow proxy to be passed in directly to supersede this value
         session.proxies = settings['proxies']
 
-        if settings['verify'] is not None or self.ca_trust_path is not None:
+        # specified validation mode takes precedence
+        session.verify = self.server_cert_validation == 'validate'
+
+        # patch in CA path override if one was specified in init or env
+        if session.verify and (self.ca_trust_path is not None or settings['verify'] is not None):
+            # session.verify can be either a bool or path to a CA store; prefer passed-in value over env if both are present
             session.verify = self.ca_trust_path or settings['verify']
 
         encryption_available = False

server_cert_validation 'ignore' no longer works in 0.3.0
The following no longer works against a self-signed certificate, has `server_cert_validation` changed? 

```
from winrm.protocol import Protocol

p = Protocol(
    endpoint='https://somewindows:5986/wsman',
    transport='ntlm',
    username=r'\Admin',
    password='ThePassword1',
    server_cert_validation='ignore')
shell_id = p.open_shell()
command_id = p.run_command(shell_id, 'ipconfig', ['/all'])
std_out, std_err, status_code = p.get_command_output(shell_id, command_id)
print std_out
p.cleanup_command(shell_id, command_id)
p.close_shell(shell_id)
```

> Traceback (most recent call last):
>   File "winrmtest.py", line 9, in <module>
>     shell_id = p.open_shell()
>   File "/usr/lib/python2.7/site-packages/winrm/protocol.py", line 157, in open_shell
>     res = self.send_message(xmltodict.unparse(req))
>   File "/usr/lib/python2.7/site-packages/winrm/protocol.py", line 234, in send_message
>     resp = self.transport.send_message(message)
>   File "/usr/lib/python2.7/site-packages/winrm/transport.py", line 256, in send_message
>     response = self._send_message_request(prepared_request, message)
>   File "/usr/lib/python2.7/site-packages/winrm/transport.py", line 261, in _send_message_request
>     response = self.session.send(prepared_request, timeout=self.read_timeout_sec)
>   File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 618, in send
>     r = adapter.send(request, **kwargs)
>   File "/usr/lib/python2.7/site-packages/requests/adapters.py", line 506, in send
>     raise SSLError(e, request=request)
> requests.exceptions.SSLError: HTTPSConnectionPool(host='123.45.67.89', port=5986): Max retries exceeded with url: /wsman (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))



With:

```
pip show pywinrm
---
Metadata-Version: 2.0
Name: pywinrm
Version: 0.3.0
Summary: Python library for Windows Remote Management
Home-page: http://github.com/diyan/pywinrm/
Author: Alexey Diyan
Author-email: alexey.diyan@gmail.com
Installer: pip
License: MIT license
Location: /usr/lib/python2.7/site-packages
Requires: six, requests-ntlm, requests, xmltodict
Classifiers:
  Development Status :: 4 - Beta
  Environment :: Console
  Intended Audience :: Developers
  Intended Audience :: System Administrators
  Natural Language :: English
  License :: OSI Approved :: MIT License
  Programming Language :: Python
  Programming Language :: Python :: 2
  Programming Language :: Python :: 2.6
  Programming Language :: Python :: 2.7
  Programming Language :: Python :: 3
  Programming Language :: Python :: 3.3
  Programming Language :: Python :: 3.4
  Programming Language :: Python :: 3.5
  Programming Language :: Python :: 3.6
  Programming Language :: Python :: Implementation :: PyPy
  Topic :: Software Development :: Libraries :: Python Modules
  Topic :: System :: Clustering
  Topic :: System :: Distributed Computing
  Topic :: System :: Systems Administration
```

However this previous release does work

```
pip show pywinrm
---
Metadata-Version: 2.0
Name: pywinrm
Version: 0.2.2
Summary: Python library for Windows Remote Management
Home-page: http://github.com/diyan/pywinrm/
Author: Alexey Diyan
Author-email: alexey.diyan@gmail.com
Installer: pip
License: MIT license
Location: /usr/lib/python2.7/site-packages
Requires: six, requests-ntlm, requests, xmltodict
Classifiers:
  Development Status :: 4 - Beta
  Environment :: Console
  Intended Audience :: Developers
  Intended Audience :: System Administrators
  Natural Language :: English
  License :: OSI Approved :: MIT License
  Programming Language :: Python
  Programming Language :: Python :: 2
  Programming Language :: Python :: 2.6
  Programming Language :: Python :: 2.7
  Programming Language :: Python :: 3
  Programming Language :: Python :: 3.3
  Programming Language :: Python :: 3.4
  Programming Language :: Python :: 3.5
  Programming Language :: Python :: 3.6
  Programming Language :: Python :: Implementation :: PyPy
  Topic :: Software Development :: Libraries :: Python Modules
  Topic :: System :: Clustering
  Topic :: System :: Distributed Computing
  Topic :: System :: Systems Administration
```


  
diff --git a/winrm/tests/test_transport.py b/winrm/tests/test_transport.py
index 94ebe32..14e00cf 100644
--- a/winrm/tests/test_transport.py
+++ b/winrm/tests/test_transport.py
@@ -1,21 +1,63 @@
 # coding=utf-8
 import os
+import tempfile
 from winrm.transport import Transport
 
 
-def test_build_session():
-    transport = Transport(endpoint="Endpoint",
+def test_build_session_cert_validate():
+    t_default = Transport(endpoint="Endpoint",
                           server_cert_validation='validate',
                           username='test',
                           password='test',
                           auth_method='basic',
                           )
-    os.environ['REQUESTS_CA_BUNDLE'] = 'path_to_REQUESTS_CA_CERT'
-    transport.build_session()
-    assert(transport.session.verify == 'path_to_REQUESTS_CA_CERT')
-    del os.environ['REQUESTS_CA_BUNDLE']
+    t_ca_override = Transport(endpoint="Endpoint",
+                              server_cert_validation='validate',
+                              username='test',
+                              password='test',
+                              auth_method='basic',
+                              ca_trust_path='overridepath',
+                              )
+    try:
+        os.environ['REQUESTS_CA_BUNDLE'] = 'path_to_REQUESTS_CA_CERT'
+        t_default.build_session()
+        t_ca_override.build_session()
+        assert(t_default.session.verify == 'path_to_REQUESTS_CA_CERT')
+        assert(t_ca_override.session.verify == 'overridepath')
+    finally:
+        del os.environ['REQUESTS_CA_BUNDLE']
 
-    os.environ['CURL_CA_BUNDLE'] = 'path_to_CURL_CA_CERT'
-    transport.build_session()
-    assert(transport.session.verify == 'path_to_CURL_CA_CERT')
-    del os.environ['CURL_CA_BUNDLE']
+    try:
+        os.environ['CURL_CA_BUNDLE'] = 'path_to_CURL_CA_CERT'
+        t_default.build_session()
+        t_ca_override.build_session()
+        assert(t_default.session.verify == 'path_to_CURL_CA_CERT')
+        assert (t_ca_override.session.verify == 'overridepath')
+    finally:
+        del os.environ['CURL_CA_BUNDLE']
+
+
+def test_build_session_cert_ignore():
+    t_default = Transport(endpoint="Endpoint",
+                          server_cert_validation='ignore',
+                          username='test',
+                          password='test',
+                          auth_method='basic',
+                          )
+    t_ca_override = Transport(endpoint="Endpoint",
+                              server_cert_validation='ignore',
+                              username='test',
+                              password='test',
+                              auth_method='basic',
+                              ca_trust_path='boguspath'
+                              )
+    try:
+        os.environ['REQUESTS_CA_BUNDLE'] = 'path_to_REQUESTS_CA_CERT'
+        os.environ['CURL_CA_BUNDLE'] = 'path_to_CURL_CA_CERT'
+        t_default.build_session()
+        t_ca_override.build_session()
+        assert(isinstance(t_default.session.verify, bool) and not t_default.session.verify)
+        assert (isinstance(t_ca_override.session.verify, bool) and not t_ca_override.session.verify)
+    finally:
+        del os.environ['REQUESTS_CA_BUNDLE']
+        del os.environ['CURL_CA_BUNDLE']

pip install -e .[kerberos,credssp]
parse_log_pytest_v2
requirements.txt
pytest pytest-cov pytest-pep8 mock
apt-get update apt-get install -y gcc
3.6
requirements-test.txt
py.test -v --pep8 --cov=winrm --cov-report=term-missing winrm/tests/
certifi==2021.5.30
cffi==1.15.1
charset-normalizer==2.0.12
coverage==6.2
cryptography==40.0.2
dataclasses==0.8
decorator==5.1.1
execnet==1.9.0
gssapi==1.7.3
idna==3.10
krb5==0.3.0
mock==5.2.0
ntlm-auth==1.5.0
pep8==1.7.1
py==1.11.0
pycparser==2.21
pyspnego==0.5.4
pytest==3.2.5
pytest-cache==1.0
pytest-cov==2.6.0
pytest-pep8==1.0.6
-e git+https://github.com/diyan/pywinrm.git@eb6a408e3941260e753b6596eab1f099cddc6515#egg=pywinrm
requests==2.27.1
requests-credssp==2.0.0
requests-kerberos==0.15.0
requests-ntlm==1.1.0
six==1.17.0
urllib3==1.26.20
xmltodict==0.14.2

name: pywinrm
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=21.2.2=py36h06a4308_0
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - setuptools=58.0.4=py36h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - cffi==1.15.1
      - charset-normalizer==2.0.12
      - coverage==6.2
      - cryptography==40.0.2
      - dataclasses==0.8
      - decorator==5.1.1
      - execnet==1.9.0
      - gssapi==1.7.3
      - idna==3.10
      - krb5==0.3.0
      - mock==5.2.0
      - ntlm-auth==1.5.0
      - pep8==1.7.1
      - py==1.11.0
      - pycparser==2.21
      - pyspnego==0.5.4
      - pytest==3.2.5
      - pytest-cache==1.0
      - pytest-cov==2.6.0
      - pytest-pep8==1.0.6
      - requests==2.27.1
      - requests-credssp==2.0.0
      - requests-kerberos==0.15.0
      - requests-ntlm==1.1.0
      - six==1.17.0
      - urllib3==1.26.20
      - xmltodict==0.14.2
prefix: /opt/conda/envs/pywinrm

winrm/tests/test_transport.py::test_build_session_cert_ignore
winrm/tests/__init__.py winrm/tests/conftest.py winrm/tests/test_cmd.py winrm/tests/test_encryption.py winrm/tests/test_encryption.py::test_init_with_invalid_protocol winrm/tests/test_encryption.py::test_encrypt_message winrm/tests/test_encryption.py::test_encrypt_large_credssp_message winrm/tests/test_encryption.py::test_decrypt_message winrm/tests/test_encryption.py::test_decrypt_message_boundary_with_end_hyphens winrm/tests/test_encryption.py::test_decrypt_message_length_mismatch winrm/tests/test_encryption.py::test_decrypt_large_credssp_message winrm/tests/test_encryption.py::test_decrypt_message_decryption_not_needed winrm/tests/test_encryption.py::test_get_credssp_trailer_length_gcm winrm/tests/test_encryption.py::test_get_credssp_trailer_length_md5_rc4 winrm/tests/test_encryption.py::test_get_credssp_trailer_length_sha256_3des winrm/tests/test_encryption.py::test_get_credssp_trailer_length_sha384_aes winrm/tests/test_encryption.py::test_get_credssp_trailer_length_no_hash winrm/tests/test_integration_protocol.py winrm/tests/test_integration_session.py winrm/tests/test_nori_type_casting.py winrm/tests/test_powershell.py winrm/tests/test_protocol.py winrm/tests/test_protocol.py::test_open_shell_and_close_shell winrm/tests/test_protocol.py::test_run_command_with_arguments_and_cleanup_command winrm/tests/test_protocol.py::test_run_command_without_arguments_and_cleanup_command winrm/tests/test_protocol.py::test_get_command_output winrm/tests/test_protocol.py::test_set_timeout_as_sec winrm/tests/test_protocol.py::test_fail_set_read_timeout_as_sec winrm/tests/test_protocol.py::test_fail_set_operation_timeout_as_sec winrm/tests/test_session.py winrm/tests/test_session.py::test_run_cmd winrm/tests/test_session.py::test_target_as_hostname winrm/tests/test_session.py::test_target_as_hostname_then_port winrm/tests/test_session.py::test_target_as_schema_then_hostname winrm/tests/test_session.py::test_target_as_schema_then_hostname_then_port winrm/tests/test_session.py::test_target_as_full_url winrm/tests/test_session.py::test_target_with_dots winrm/tests/test_transport.py::test_build_session_cert_validate winrm/tests/test_wql.py
winrm/transport.py
winrm/transport.py