Not exactly sure how to debug this (and found a workaround, so not spending lots of time on it right now..) But in case you find this interesting, or want more information… 😉 This is being executed in a ubuntu based container:

00:00:13.712   ---> Running in d7f5b34c489c
00:00:13.970  curl -L <https://path-to-custom/cacert.pem> -o .cacert.pem
00:00:13.970    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
00:00:13.970                                   Dload  Upload   Total   Spent    Left  Speed
00:00:14.228  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  284k  100  284k    0     0  3029k      0 --:--:-- --:--:-- --:--:-- 2998k
00:00:14.228  ./pants test ::
00:00:14.228  Bootstrapping Pants using /root/pyenv/bin/python3.8
00:00:14.228  Creating the virtualenv PEX.
00:00:14.228  Downloading the Pex PEX.
00:00:14.228    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
00:00:14.228                                   Dload  Upload   Total   Spent    Left  Speed
00:00:14.487  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100   640  100   640    0     0   2442      0 --:--:-- --:--:-- --:--:--  2442
00:00:14.747  
100 3529k  100 3529k    0     0  6012k      0 --:--:-- --:--:-- --:--:-- 6012k
00:00:15.012  SHA256 fingerprint of <https://github.com/pantsbuild/pex/releases/download/v2.1.42/pex> verified.
00:00:21.588  ERROR: Exception:
00:00:21.588  Traceback (most recent call last):
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/cli/base_command.py", line 223, in _main
00:00:21.588      status = self.run(options, args)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/cli/req_command.py", line 180, in wrapper
00:00:21.588      return func(self, options, args)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/commands/download.py", line 130, in run
00:00:21.588      requirement_set = resolver.resolve(
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/resolution/legacy/resolver.py", line 180, in resolve
00:00:21.588      discovered_reqs.extend(self._resolve_one(requirement_set, req))
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/resolution/legacy/resolver.py", line 385, in _resolve_one
00:00:21.588      dist = self._get_dist_for(req_to_install)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/resolution/legacy/resolver.py", line 336, in _get_dist_for
00:00:21.588      self._populate_link(req)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/resolution/legacy/resolver.py", line 302, in _populate_link
00:00:21.588      req.link = self._find_requirement_link(req)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/resolution/legacy/resolver.py", line 267, in _find_requirement_link
00:00:21.588      best_candidate = self.finder.find_requirement(req, upgrade)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/index/package_finder.py", line 899, in find_requirement
00:00:21.588      best_candidate_result = self.find_best_candidate(
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/index/package_finder.py", line 882, in find_best_candidate
00:00:21.588      candidates = self.find_all_candidates(project_name)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/index/package_finder.py", line 825, in find_all_candidates
00:00:21.588      package_links = self.process_project_url(
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/index/package_finder.py", line 789, in process_project_url
00:00:21.588      html_page = self._link_collector.fetch_page(project_url)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/index/collector.py", line 618, in fetch_page
00:00:21.588      return _get_html_page(location, session=self.session)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/index/collector.py", line 430, in _get_html_page
00:00:21.588      resp = _get_html_response(url, session=session)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/index/collector.py", line 127, in _get_html_response
00:00:21.588      resp = session.get(
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_vendor/requests/sessions.py", line 555, in get
00:00:21.588      return self.request('GET', url, **kwargs)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_internal/network/session.py", line 428, in request
00:00:21.588      return super(PipSession, self).request(method, url, *args, **kwargs)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_vendor/requests/sessions.py", line 542, in request
00:00:21.588      resp = self.send(prep, **send_kwargs)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_vendor/requests/sessions.py", line 655, in send
00:00:21.588      r = adapter.send(request, **kwargs)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_vendor/cachecontrol/adapter.py", line 53, in send
00:00:21.588      resp = super(CacheControlAdapter, self).send(request, **kw)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_vendor/requests/adapters.py", line 416, in send
00:00:21.588      self.cert_verify(conn, request.url, verify, cert)
00:00:21.588    File "/root/.pex/venvs/short/b70d1f7c/lib/python3.8/site-packages/pip/_vendor/requests/adapters.py", line 227, in cert_verify
00:00:21.588      raise IOError("Could not find a suitable TLS CA certificate bundle, "
00:00:21.588  OSError: Could not find a suitable TLS CA certificate bundle, invalid path: .cacert.pem
00:00:21.588  /root/.pex/unzipped_pexes/478cc1fa371ca40aa3e7dafee735ca438d4a243f/.deps/pex-2.1.42-py2.py3-none-any.whl/pex/tools/commands/venv.py:141: PEXWarning: Encountered collision building venv at /root/.pex/venvs/short/b70d1f7c from /root/.pex/pip.pex/46820cb5af0dcf9295a4e7f30184cc0e9fa063dc:
00:00:21.588  1. /root/.pex/venvs/6bc8f4e11b4bf9d3e1b148a27604670c4da9e9ec/23c599ba15ab7a6087ae225bb95a4ab6e3524583.2e9bba63df3c4868b1c746844ee275f0/lib/python3.8/site-packages/constraints.txt was provided by:
00:00:21.588  	/root/.pex/pip.pex/46820cb5af0dcf9295a4e7f30184cc0e9fa063dc/.deps/setuptools/constraints.txt
00:00:21.588  	/root/.pex/pip.pex/46820cb5af0dcf9295a4e7f30184cc0e9fa063dc/.deps/wheel/constraints.txt
00:00:21.588    pex_warnings.warn(message)
00:00:21.588  pid 87 -> /root/.pex/venvs/6bc8f4e11b4bf9d3e1b148a27604670c4da9e9ec/23c599ba15ab7a6087ae225bb95a4ab6e3524583/pex --disable-pip-version-check --no-python-version-warning --exists-action a --use-deprecated legacy-resolver --isolated -q --cache-dir /root/.pex download --dest /tmp/tmpfyu06iuz/usr.bin.python3.8 --requirement requirements.txt --index-url <https://pypi.org/simple> --retries 5 --timeout 15 exited with 2 and STDERR:
00:00:21.588  None
00:00:21.589  mv: cannot stat '/root/.cache/pants/setup/bootstrap-Linux-x86_64/pants.0dPTbe/virtualenv.pex': No such file or directory
00:00:21.589  Installing pantsbuild.pants==2.9.0rc1 into a virtual environment at /root/.cache/pants/setup/bootstrap-Linux-x86_64/2.9.0rc1_py38
00:00:21.589  /root/pyenv/bin/python3.8: can't open file '/root/.cache/pants/setup/bootstrap-Linux-x86_64/virtualenv-20.4.7/virtualenv.pex': [Errno 2] No such file or directory

The cert is setup with a:

export PANTS_CA_CERTS_PATH=$(pwd)/.cacert.pem

The workaround was to simply run

./pants version

first, as that bootstraped successfully, and then the

./pants test ::

works too after that..