Support for environment-based CA bundle configuration in httpx

[ityshchenko]

Background

Currently, httpx requires explicit configuration of CA certificates through the verify parameter in httpx.Client/httpx.AsyncClient. However, other popular HTTP client libraries in the Python ecosystem (pip, requests, boto3) support environment-based CA bundle configuration through variables like REQUESTS_CA_BUNDLE and CURL_CA_BUNDLE.

Problem Statement

The lack of environment-based CA bundle configuration in httpx creates inconsistency with other Python HTTP clients and makes it harder to configure SSL/TLS verification across an entire application environment. Users currently must explicitly pass CA bundle paths to each httpx client instance, even when the environment already specifies a preferred CA bundle location.

Motivation

• Consistency with other Python client libraries (pip, requests, boto3)
• Easier system-wide CA bundle configuration
• Better support for containerized environments where CA bundles are injected via environment variables
• Simplified configuration in environments with custom CA certificates

Implementation Questions

1. Environment variable priority vs. verify parameter
   Should environment variables override the verify parameter in httpx.Client/httpx.AsyncClient? Options include:

• Environment variables take precedence over verify parameter takes precedence over environment variables
• Only use environment variables when verify=True (default behavior)

2. Environment Variable Names
   Which environment variables should httpx support? Options include:

• Create a new HTTPX_CA_BUNDLE variable
• Support existing variables (REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE)
• Support both with a defined priority order

3. CA Bundle Resolution Priority
   What should be the priority order when multiple CA bundle sources are available? Suggested order:
   Explicit verify parameter (if not default)

• HTTPX_CA_BUNDLE (if implemented)
• REQUESTS_CA_BUNDLE
• CURL_CA_BUNDLE
• System default CA bundle

4. Windows-specific Considerations
   Should httpx provide a Windows-specific environment variable for truststore configuration? This would be similar to how some other libraries handle Windows certificate stores differently from CA bundle files.

[ityshchenko]

I've reviewed docs few times more and found that's not a bug, but feature.

Unlike requests, the httpx package does not automatically pull in the environment variables SSL_CERT_FILE or SSL_CERT_DIR. If you want to use these they need to be enabled explicitly.

[iwinux]

The code does not agree with the docs :)

httpx/httpx/_config.py

Lines 33 to 37 in 6c7af96

	if verify is True:
	if trust_env and os.environ.get("SSL_CERT_FILE"): # pragma: nocover
	ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])
	elif trust_env and os.environ.get("SSL_CERT_DIR"): # pragma: nocover
	ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])