The default set of certificates should always be ignored when SSL_CERT_DIR or SSL_CERT_FILE is used

#17543 revealed that we have confusing behavior for this today.

If they are set but there is no content at the target, we still use the system or bundled Mozilla certificates.
If they are set but the content at the target is invalid, we have an empty certificate store.

For consistency with other tools, e.g., Go and OpenSSL, we should probably always have an empty certificate store if they are set to a target, regardless of whether or not the target path exists.

@zanieb

@zanieb
wdyt, #17543 expected to land first? I was looking into this, then into #17543, and realized that making the change against main vs making it there would have a different shape and likely wouldn't be cherry-pickable.

We can't make this change until the next breaking release. It'll need to follow #17543, yeah.

Honor explicit certificate sources even when empty (#20741)

Honor explicit certificate sources even when empty (astral-sh#20741)

Navigation Menu

Repository navigation

The default set of certificates should always be ignored when `SSL_CERT_DIR` or `SSL_CERT_FILE` is used #18526

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

The default set of certificates should always be ignored when SSL_CERT_DIR or SSL_CERT_FILE is used #18526

Description

Activity

denyszhak commented on Mar 19, 2026

zanieb commented on Mar 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The default set of certificates should always be ignored when `SSL_CERT_DIR` or `SSL_CERT_FILE` is used #18526