Adam Migus

The CA cert is present in what root bundle? Is there a certain root bundle that ansible is supposed to check? Are lookup plugins expected to accept 'validate_certs'?

In that case, I don't think any changes are needed. Please use the method supported by the underlying requests library to trust the CA cert.

If Ansible were to expose verify so that we can piggyback, that's fine but, I don't see why a plugin should expose its underlying library so that users can avoid...

Likewise, I don't see why an individual Ansible plugin should couple itself to a particular location for a CA certificate bundle nor do I see why it should couple itself...