We are using a firewall that does Deep Packet Inspection, so it uses an internal custom CA and every client must import this CA to the trusted ca list, or every https request will fail.
Now when i run:
wp-cli core download
i get the error:

Error: Failed to get url 'https://api.wordpress.org/core/version-check/1.6/?locale=en_US': cURL error 60: Peer's certificate issuer has been marked as not trusted by the user..

I've dowloaded the offial cacert.pem:
http://curl.haxx.se/ca/cacert.pem
appended our CA, and modified php.ini by adding:
curl.cainfo = /etc/curl-cacert.pem

now every php https curl call works good, even curl via command line, but not wp-cli!
with wp-cli I continue to receive the same error, why?
maybe wp-cli dosn't use the curl.cainfo setting?

i've tried even:
echo "cacert /etc/curl-cacert.pem" >> ~/.curlrc
but it still doesn't work.

Here it's some info about my envirnment:

OS: Linux 4.9.125-linuxkit #1 SMP Fri Sep 7 08:20:28 UTC 2018 x86_64
Shell:
PHP binary: /usr/bin/php
PHP version: 7.2.16
php.ini used: /etc/php.ini
WP-CLI root dir: phar://wp-cli.phar/vendor/wp-cli/wp-cli
WP-CLI vendor dir: phar://wp-cli.phar/vendor
WP_CLI phar path: /tmp
WP-CLI packages dir: /root/.wp-cli/packages/
WP-CLI global config: /root/.wp-cli/config.yml
WP-CLI project config:
WP-CLI version: 2.1.0