diff --git a/dvc/config_schema.py b/dvc/config_schema.py
--- a/dvc/config_schema.py
+++ b/dvc/config_schema.py
@@ -145,6 +145,7 @@ class RelPath(str):
                     "session_token": str,
                     Optional("listobjects", default=False): Bool,  # obsoleted
                     Optional("use_ssl", default=True): Bool,
+                    Optional("ssl_verify", default=True): Bool,
                     "sse": str,
                     "sse_kms_key_id": str,
                     "acl": str,
diff --git a/dvc/fs/s3.py b/dvc/fs/s3.py
--- a/dvc/fs/s3.py
+++ b/dvc/fs/s3.py
@@ -38,6 +38,7 @@ def __init__(self, repo, config):
         self.endpoint_url = config.get("endpointurl")
 
         self.use_ssl = config.get("use_ssl", True)
+        self.ssl_verify = config.get("ssl_verify", True)
 
         self.extra_args = {}
 
@@ -136,6 +137,7 @@ def s3(self):
         return session.resource(
             "s3",
             endpoint_url=self.endpoint_url,
+            verify=self.ssl_verify,
             use_ssl=self.use_ssl,
             config=boto3.session.Config(
                 signature_version="s3v4", s3=s3_config

We should provide this option, but it's better if user explicitly provided their custom certs via (`AWS_CA_BUNDLE`) (need to check though if it really works).
I think both options complement each other, don't see any contradiction. The same as boto probably supports both, as far as I understand. Do you have any specific concerns, @skshetry ?

No. It's just that, when you are providing custom cert, it'll still be validated. But, if the validation is entirely disabled, you are trusting anything. So, providing custom certs is more secure.

Of course, we should also support disabling validation of certs. 
> 
> 
> We should provide this option, but it's better if user explicitly provided their custom certs via (`AWS_CA_BUNDLE`) (need to check though if it really works).

I can confirm that this does work, that's what I'm doing at the moment
diff --git a/tests/unit/fs/test_s3.py b/tests/unit/fs/test_s3.py
--- a/tests/unit/fs/test_s3.py
+++ b/tests/unit/fs/test_s3.py
@@ -29,6 +29,22 @@ def test_init(dvc):
     assert fs.path_info == url
 
 
+def test_verify_ssl_default_param(dvc):
+    config = {
+        "url": url,
+    }
+    fs = S3FileSystem(dvc, config)
+
+    assert fs.ssl_verify
+
+
+def test_ssl_verify_bool_param(dvc):
+    config = {"url": url, "ssl_verify": False}
+    fs = S3FileSystem(dvc, config)
+
+    assert fs.ssl_verify == config["ssl_verify"]
+
+
 def test_grants(dvc):
     config = {
         "url": url,

s3 and compatible: add a config option to support validate_certs
Similar to use_ssl, we should probably provide a config for this.

More context here - https://discordapp.com/channels/485586884165107732/485596304961962003/685129104214851595



tests/unit/fs/test_s3.py::test_verify_ssl_default_param tests/unit/fs/test_s3.py::test_ssl_verify_bool_param
tests/unit/fs/test_s3.py::test_get_s3_connection_error tests/unit/fs/test_s3.py::test_grants_mutually_exclusive_acl_error tests/unit/fs/test_s3.py::test_get_bucket tests/unit/fs/test_s3.py::test_get_s3_no_credentials tests/unit/fs/test_s3.py::test_grants tests/unit/fs/test_s3.py::test_sse_kms_key_id tests/unit/fs/test_s3.py::test_key_id_and_secret tests/unit/fs/test_s3.py::test_init tests/unit/fs/test_s3.py::test_get_s3_connection_error_endpoint