diff --git a/python/requirements.txt b/python/requirements.txt
index 44ee760eefd..0700db2a21f 100644
--- a/python/requirements.txt
+++ b/python/requirements.txt
@@ -26,4 +26,9 @@ colorama == 0.3.7
 # For package uploading
 boto3 == 1.4.4
 
+# Default root CAs on Windows CI do not trust CloudFront certificates,
+# connecting to https://static.rust-lang.org would fail:
+# https://github.com/servo/servo/pull/18942
+certifi
+
 -e python/tidy
diff --git a/python/servo/util.py b/python/servo/util.py
index 30de9fba847..485637b81f1 100644
--- a/python/servo/util.py
+++ b/python/servo/util.py
@@ -19,6 +19,7 @@ import sys
 import tarfile
 import zipfile
 import urllib2
+import certifi
 
 
 def delete(path):
@@ -73,7 +74,7 @@ def download(desc, src, writer, start_byte=0):
         req = urllib2.Request(src)
         if start_byte:
             req = urllib2.Request(src, headers={'Range': 'bytes={}-'.format(start_byte)})
-        resp = urllib2.urlopen(req)
+        resp = urllib2.urlopen(req, cafile=certifi.where())
 
         fsize = None
         if resp.info().getheader('Content-Length'):