Unfortunately pip does not use the system certs, but curl does.
I found a solution:
pip --cert /etc/ssl/certs/FOO_Root_CA.pem install pep8
This is not nice (curl and other libraries find the cert without adding a parameter) but works.
If you don’t want to use the command line argument, you can set the cert in ~/.pip/pip.conf:
[global]
cert = /etc/ssl/certs/Foo_Root_CA.pem