Skip to content

Respect REQUESTS_CA_BUNDLE environment variable #664

@thwllms

Description

@thwllms

Sitting behind a corporate VPN/firewall which performs HTTPS inspection / SSL certificate replacement, I have to configure my environment to deal with otherwise fishy-looking certificates issued by the system. By default the basic requests.get, requests.post, etc., functions look for an environment variable REQUESTS_CA_BUNDLE (see docs), which points to a custom certificate bundle file that includes the Root CA for my company's VPN/firewall system. That one setting solves a lot of issues in Python land.

pystac-client, however, doesn't seem to respect that environment variable. It uses raw Request and Session objects to set up requests, resulting in this error:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)

I think the send method call on this line should probably account for REQUESTS_CA_BUNDLE via the verify argument, something like this:

from requests import Request, Session
import os

session = Session()
request = Request(method="GET", url="https://example.com")
prepped = session.prepare_request(request)
response = session.send(prepped, verify=os.environ.get("REQUESTS_CA_BUNDLE"))

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions