[v2 Bug] dbt-fusion: HTTP client breaks behind corporate SSL inspection proxies and ignores SSL_CERT_FILE

Is this a new bug in dbt v2.x compared to the latest version of dbt 1.x?

• I believe this is a new bug in dbt v2.x
• I have searched the existing issues and could not find a duplicate

Current Behavior

The fusion binary's HTTP client does not honour SSL_CERT_FILE (or any other env var) for injecting enterprise/custom CA certificates.

Setting:

$env:SSL_CERT_FILE = "C:\path\to\corporate-ca-bundle.pem"

before running dbt parse --use-v2-parser has no effect; the binary still fails to verify the TLS certificate presented by the corporate proxy (Zscaler) for hub.getdbt.com.

dbt v1 works in the same environment via python-certifi-win32, which patches Python's certifi bundle with Windows root CAs.

The fusion binary appears to use rustls with a bundled Mozilla CA store rather than the platform certificate store or an env-var-configurable store.

Expected Behavior

At minimum one of:

• Respect SSL_CERT_FILE (standard OpenSSL env var) to append extra CA PEM bundles
• Use the OS/platform certificate store on Windows (via rustls-platform-verifier or native-tls) so enterprise root CAs installed in the Windows cert store are trusted automatically

Steps To Reproduce

1. Have a dbt 1.12 project with hub-sourced packages in packages.yml (e.g. package: dbt-labs/dbt_utils, version: 1.4.1)
2. Run dbt deps (v1) to populate dbt_packages/ — succeeds
3. In a network environment where hub.getdbt.com is unreachable (corporate firewall / SSL inspection proxy), run: dbt parse --use-v2-parser
4. Parse fails despite all packages already being present on disk

Relevant log output

### Attempt 1 — without SSL_CERT_FILE

==================== 2026-08-04T13:19:47.185348Z ====================
13:19:47.185515 [info ]: dbt-core 2.0.0-alpha.5
13:19:47.191832 [info ]: Started loading project
13:19:47.191832 [info ]: Loading profiles.yml
13:19:47.218564 [info ]:    Started resolving packages from packages.yml
13:19:51.704843 [info ]:     Failed [  4.49s] resolving packages from packages.yml
    (error: Failed to get index from https://hub.getdbt.com/api/v1/index.json;
    status: Request failed after 3 retries)
13:19:51.706039 [info ]: Finished loading project [  4.52s]
13:19:51.706407 [error]: [RuntimeError (dbt8999)]: Failed to get index from
    https://hub.getdbt.com/api/v1/index.json; status: Request failed after 3 retries
15:19:51.772103 [error] [MainThread]: v2 parser failed after 11.42s (FusionParserError, exit_code=1)

### Attempt 2 — with SSL_CERT_FILE set to a PEM bundle of all Windows root CAs
#   ($env:SSL_CERT_FILE = exported PEM containing enterprise Zscaler root CA)

==================== 2026-08-04T13:25:xx ====================
13:25:xx [info ]: dbt-core 2.0.0-alpha.5
13:25:xx [info ]:    Started resolving packages from packages.yml
13:25:xx [info ]:     Failed [  2.07s] resolving packages from packages.yml
    (error: Failed to get index from https://hub.getdbt.com/api/v1/index.json;
    status: Request failed after 3 retries)

Notable: the binary produces no SSL-specific error (no "certificate verify failed",
no TLS handshake error) — just a generic "Request failed". SSL_CERT_FILE visibly
changes the retry timing (4.49s → 2.07s) but does not resolve the failure, suggesting
the env var is partially detected but the underlying TLS trust store is not updated.

Environment

- OS: Windows 11 (NT 10.0.26200.0)
- CPU: x86-64
- dbt distribution and version:
  Core:       1.12.0
  Plugins:    dbt-databricks 1.12.3
  Fusion:     dbt-core 2.0.0-alpha.5 (dbt-core-experimental-parser.exe)
  Installed via: uv / pip (not Homebrew or standalone binary)

Which database adapter are you using?

databricks

Is this a discrepancy vs. dbt 1.x?

• Yes — this works in dbt 1.x but not in dbt v2.x

Additional Context

13:25:19 Running with dbt=1.12.0 13:25:20 Delegating parse to v2 parser: dbt-core-experimental-parser parse dbt-core 2.0.0-alpha.5 Loading profiles.yml Failed [ 2.07s] resolving packages from packages.yml (error: Failed to get index from https://hub.getdbt.com/api/v1/index.json; status: Request failed after 3 retries)

======================================= Errors and Warnings ======================================== [error] [RuntimeError (dbt8999)]: Failed to get index from https://hub.getdbt.com/api/v1/index.json; status: Request failed after 3 retries

Suggested approach

Switch to rustls-platform-verifier for TLS trust anchors (already supports Windows CertStore), which would make the binary work in corporate environments without any manual configuration.