> Or npm and pip use their own certificate stacks and refuse the firewall's cert, which is ... good I guess. Combined with the fact that chrome is the only all

> Or npm and pip use their own certificate stacks and refuse the firewall's cert, which is ... good I guess. Combined with the fact that chrome is the only allowed browser, I suspect it is the other way around. Chrome uses its own certificate stack, and I would guess IT only added the MITM certificate to the chrome trusted CA list, not the system one.