Originally opened by @sethmlarson on 2019-09-01 05:47:20 in encode/httpx
This is an issue that many people have been trying to tackle for Python but hasn't been done yet. I think we're in a pretty good position to try to tackle this in a way that cam be available to everyone.
- Linux/OpenSSL should use the default system CA bundle path compiled into OpenSSL.
- Windows should use SChannel which is capable of fetching updated CA certs if they're not in the trust store.
- macOS should use SecureTransport
This should probably be implemented as a separate library, maybe use a stripped-down oscrypto project as a starting point.
Reasons to do this:
- HTTPX will use the same CA certs as the system
- Easier configuration and deployment to corporate settings
- If a system is shipped with outdated OpenSSL (Windows, macOS) we don't care because the system is more likely to be up to date than whatever was shipped with Python.
- Windows and macOS automatically update their certs and CRLs.
This is an issue that many people have been trying to tackle for Python but hasn't been done yet. I think we're in a pretty good position to try to tackle this in a way that cam be available to everyone.
This should probably be implemented as a separate library, maybe use a stripped-down oscrypto project as a starting point.
Reasons to do this: