The Rovo Dev CLI (and the new Rovo CLI) currently lacks a built-in mechanism to trust custom Certificate Authority (CA) bundles. This causes the CLI to fail in enterprise environments that use SSL-inspecting firewalls or transparent proxies, as the CLI's underlying SSL verification (Python certifi-based) rejects the self-signed certificates injected into the chain.

Current Behavior:
When running acli rovodev run behind an SSL-inspecting firewall, the CLI returns multiple errors similar to:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1018)

Impact:
Enterprise customers with strict network security policies cannot use Rovo CLI tools without manually setting environment variables (REQUESTS_CA_BUNDLE or SSL_CERT_FILE), which is not a discoverable or standard user experience for a CLI tool.

Suggested Solution:

• CA Bundle Support: Add a configuration option or flag (e.g., --cacert or a config file setting) to allow users to specify a path to a custom CA bundle.
• Proxy Configuration: Add explicit support for HTTP_PROXY and HTTPS_PROXY configuration within the CLI settings.
• System Trust Store: Improve the CLI's ability to automatically detect and use the operating system's native trust store (e.g., using libraries like pip-system-certs or similar for Python-based tools).

Workaround:
Users must currently export environment variables before running the CLI:

export REQUESTS_CA_BUNDLE=/path/to/cert.pem

or

export SSL_CERT_FILE=/path/to/your/corporate-ca-bundle.crt