diff --git a/src/azure-cli/azure/cli/command_modules/resource/_bicep.py b/src/azure-cli/azure/cli/command_modules/resource/_bicep.py
index 6e23769fa6f..e71af9dd44b 100644
--- a/src/azure-cli/azure/cli/command_modules/resource/_bicep.py
+++ b/src/azure-cli/azure/cli/command_modules/resource/_bicep.py
@@ -9,6 +9,7 @@
 import platform
 import subprocess
 import json
+import certifi
 
 from json.decoder import JSONDecodeError
 from contextlib import suppress
@@ -106,8 +107,8 @@ def ensure_bicep_installation(release_tag=None, stdout=True):
                 print(f"Installing Bicep CLI {release_tag}...")
             else:
                 print("Installing Bicep CLI...")
-
-        request = urlopen(_get_bicep_download_url(system, release_tag))
+        ca_file = certifi.where()
+        request = urlopen(_get_bicep_download_url(system, release_tag), cafile=ca_file)
         with open(installation_path, "wb") as f:
             f.write(request.read())
 
@@ -140,7 +141,8 @@ def is_bicep_file(file_path):
 
 def get_bicep_available_release_tags():
     try:
-        response = requests.get("https://aka.ms/BicepReleases")
+        ca_file = certifi.where()
+        response = requests.get("https://aka.ms/BicepReleases", verify=ca_file)
         return [release["tag_name"] for release in response.json()]
     except IOError as err:
         raise ClientRequestError(f"Error while attempting to retrieve available Bicep versions: {err}.")
@@ -148,7 +150,8 @@ def get_bicep_available_release_tags():
 
 def get_bicep_latest_release_tag():
     try:
-        response = requests.get("https://aka.ms/BicepLatestRelease")
+        ca_file = certifi.where()
+        response = requests.get("https://aka.ms/BicepLatestRelease", verify=ca_file)
         response.raise_for_status()
         return response.json()["tag_name"]
     except IOError as err: