Using Windows Certificate Store

[MikuAuahDark]

Hello, I'm trying to use httpx through my local network using custom CA which I installed in Windows. However, httpx seems unable to verify the certificate.

>>> httpx.get("https://myotherpc-1234.local")
Traceback (most recent call last):
  File "C:\Program Files\Python310\lib\site-packages\httpcore\_exceptions.py", line 10, in map_exceptions
    yield
  File "C:\Program Files\Python310\lib\site-packages\httpcore\backends\sync.py", line 62, in start_tls
    raise exc
  File "C:\Program Files\Python310\lib\site-packages\httpcore\backends\sync.py", line 57, in start_tls
    sock = ssl_context.wrap_socket(
  File "C:\Program Files\Python310\lib\ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\Program Files\Python310\lib\ssl.py", line 1071, in _create
    self.do_handshake()
  File "C:\Program Files\Python310\lib\ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)

With requests, it works after installing pip-system-certs:

>>> requests.get("https://myotherpc-1234.local")
>>>

Windows built-in curl also works.

C:\Users\MikuAuahDark>where curl
C:\Windows\System32\curl.exe

C:\Users\MikuAuahDark>curl -I https://myotherpc-1234.local
HTTP/1.1 200 OK
...

So I'm 100% sure my CA is installed successfully.

I'm running httpx 0.23.1, if that matters.

[lovelydinosaur]

Hrm... could you try the following...

import httpx
import ssl

ssl_context = ssl.create_default_context()
ssl_context.load_default_certs()
httpx.get(..., verify=context)

[MikuAuahDark]

It works, thanks.

[lovelydinosaur]

Great. For future reference, I figured that out from looking at what SSLContext the pip-system-certs package uses.

    def init_poolmanager(wrapped, _instance, args, kwargs):
        # type: (pip._vendor.requests.adapters.HTTPAdapter.init_poolmanager, None, list, dict) -> None
        import ssl
        ssl_context = ssl.create_default_context()
        ssl_context.load_default_certs()
        kwargs['ssl_context'] = ssl_context
        wrapped(*args, **kwargs)

If you're able to spare a little more time on this, it'd also be really helpful to know if the truststore package gets this right...

Does the following also work for you?...

$ pip install truststore

import httpx
import truststore

ssl_context = truststore.SSLContext()
httpx.get(..., verify=ssl_context)

[MikuAuahDark]

Yep, also works with that, however truststore.SSLContext() gives me 2 deprecation warnings:

<stdin>:1: DeprecationWarning: ssl.SSLContext() without protocol argument is deprecated.
<stdin>:1: DeprecationWarning: ssl.PROTOCOL_TLS is deprecated

[lovelydinosaur]

Okay, you'd probably want this, then...

import httpx
import ssl
import truststore

ssl_context = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
httpx.get(..., verify=ssl_context)

Does that work without warnings?

[MikuAuahDark]

Yep, works without warnings.