add_ca_cert_to_python.sh

#!/usr/bin/env bash
set -eu
declare -t _lastcmd; trap '_lastcmd="$BASH_COMMAND"' DEBUG; trap 'echo "LINE $LINENO: $_lastcmd"' EXIT;

# export CA PEM from Apple "Keychain Access" app and pass as ARG1
new_ca_cert="$1"

get_python_cert_chain(){
    python -m certifi
}

backup_file(){
    original_file="$1"
    cp -v "$original_file" "$original_file.$(date +%s)"
}

prepend_metadata_comments(){
    cert_file="$1"
    (
        openssl x509 -subject -noout -in "$cert_file"
    ) | sed $'1i\\\n\n;s/^/# /;'
    cat "$cert_file"
}

main(){
    original_cert_chain="$(get_python_cert_chain)"
    backup_file "$original_cert_chain"
    prepend_metadata_comments "$new_ca_cert" \
      | tee -a "$original_cert_chain"
}

trap - EXIT
main

nice! :)