2.32.3 does not load system CA certificates when using an Adapter #6736
Description
Given this snippet:
from requests.adapters import HTTPAdapter
from requests import Session
from urllib3 import PoolManager
from urllib3 import ProxyManager
from urllib3.util.ssl_ import create_urllib3_context
class AFIPAdapter(HTTPAdapter):
"""An adapter with reduced security so it'll work with AFIP."""
def init_poolmanager(self, *args, **kwargs) -> PoolManager:
context = create_urllib3_context(ciphers="AES128-SHA")
# context.load_default_certs()
kwargs["ssl_context"] = context
return super().init_poolmanager(*args, **kwargs)
def proxy_manager_for(self, *args, **kwargs) -> ProxyManager:
context = create_urllib3_context(ciphers="AES128-SHA")
# context.load_default_certs()
kwargs["ssl_context"] = context
return super().proxy_manager_for(*args, **kwargs)
session = Session()
session.mount("https://servicios1.afip.gov.ar", AFIPAdapter())
session.get("https://servicios1.afip.gov.ar/wsfev1/service.asmx?WSDL")On requests==2.31.0, this works fine (e.g.: system CAs are loaded by default).
As of 2.32.2, the system CAs are no longer loaded by default, and the commented context.load_default_certs() lines need to be included too.
Expected Result
Above snippet should work; system CAs should be loaded.
Actual Result
Above snippet fails with:
requests.exceptions.SSLError: HTTPSConnectionPool(host='servicios1.afip.gov.ar', port=443): Max retries exceeded with url: /wsfev1/service.asmx?WSDL (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)
System Information
$ python -m requests.help
{
"chardet": {
"version": null
},
"charset_normalizer": {
"version": "3.3.2"
},
"cryptography": {
"version": "39.0.2"
},
"idna": {
"version": "3.7"
},
"implementation": {
"name": "CPython",
"version": "3.12.3"
},
"platform": {
"release": "6.9.3-0-edge",
"system": "Linux"
},
"pyOpenSSL": {
"openssl_version": "30000080",
"version": "23.2.0"
},
"requests": {
"version": "2.32.3"
},
"system_ssl": {
"version": "30300000"
},
"urllib3": {
"version": "2.2.1"
},
"using_charset_normalizer": true,
"using_pyopenssl": true
}