Don't. Your office proxy is re-signing TLS with its own CA. Get the CA certificate from IT and point at it: export REQUESTS_CA_BUNDLE=/path/to/corp-ca.pem. That's the same bug class as the curl thread, sort of the reverse.