diff --git a/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java b/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java
index 7571855d1..5b337757d 100644
--- a/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java
+++ b/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java
@@ -73,20 +73,20 @@
  * Controls how the the CAs that Python trusts when using SSL are determined. The mode can be set via the system
  * property {@code knime.python.cacerts} which can be set to either {@link PythonCaCertsMode#ENV} to trust the CAs of
  * the Python environment or {@link PythonCaCertsMode#AP} to trust the CAs that the AP trusts. The property match is
- * done case-insensitive and defaults to ENV, also if the property isn't set at all.
+ * done case-insensitive and defaults to AP, also if the property isn't set at all.
  *
  * @author Adrian Nembach, KNIME GmbH, Konstanz, Germany
  */
 @SuppressWarnings("javadoc")
 enum PythonCaCertsMode {
         /**
-         * Trust the CAs of the Python environment. This is the default behavior.
+         * Trust the CAs of the Python environment.
          */
         ENV(e -> {
             // leave as is
         }),
         /**
-         * Trust the CAs that the AP trusts. Creates a .crt file with the CAs that Java trusts and points the
+         * Trust the CAs that the AP trusts. This is the default behavior. Creates a .crt file with the CAs that Java trusts and points the
          * following environment variables to it:
          * <ul>
          * <li>{@code REQUESTS_CA_BUNDLE}: Respected by requests, httpx and packages that use them.
@@ -95,6 +95,8 @@ enum PythonCaCertsMode {
          */
         AP(PythonCaCertsMode::overwriteWithAPCerts);
 
+    private static final NodeLogger LOGGER = NodeLogger.getLogger(PythonCaCertsMode.class);
+
     private final Consumer<Map<String, String>> m_envModifier;
 
     PythonCaCertsMode(final Consumer<Map<String, String>> envModifier) {
@@ -107,11 +109,23 @@ enum PythonCaCertsMode {
     private static final Set<String> CA_CERT_ENV_VARS = Set.of("REQUESTS_CA_BUNDLE", "SSL_CERT_FILE");
 
     static PythonCaCertsMode fromProperty() {
-        var property = System.getProperty(PYTHON_CACERTS_PROPERTY, PythonCaCertsMode.ENV.name());
+        final String property = System.getProperty(PYTHON_CACERTS_PROPERTY);
+        if (property == null) {
+            // property not set: default to AP
+            return AP;
+        }
         if (AP.name().equalsIgnoreCase(property)) {
             return AP;
         }
-        return ENV;
+        if (ENV.name().equalsIgnoreCase(property)) {
+            return ENV;
+        }
+        LOGGER.warnWithFormat(
+            "Invalid value '%s' for system property '%s'. Falling back to '%s'.",
+            property,
+            PYTHON_CACERTS_PROPERTY,
+            AP.name());
+        return AP;
     }
 
     void updateEnvironment(final Map<String, String> environment) {