fix: improve the detection and loading of default certificates

Signed-off-by: Norbert Biczo <[email protected]>

Author: pyrooka

ibm_cloud_sdk_core/http_adapter.py

@@ -1,10 +1,10 @@
 import ssl
 
+import certifi
 from requests.adapters import HTTPAdapter, DEFAULT_POOLBLOCK
 from urllib3.util.ssl_ import create_urllib3_context
 
 
-# pylint: disable=fixme
 class SSLHTTPAdapter(HTTPAdapter):
     """Wraps the original HTTP adapter and adds additional SSL context."""
 
@@ -15,9 +15,9 @@ def __init__(self, *args, **kwargs):
 
     def init_poolmanager(self, connections, maxsize, block=DEFAULT_POOLBLOCK, **pool_kwargs):
         """Create and use custom SSL configuration."""
-
         ssl_context = create_urllib3_context()
-        ssl_context.load_default_certs()
+        # NOTE: https://github.com/psf/requests/pull/6731/files#r1622893724
+        ssl_context.load_verify_locations(certifi.where())
         ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2
 
         if self._disable_ssl_verification:

test/test_http_adapter.py

@@ -3,7 +3,7 @@
 import threading
 import warnings
 from http.server import HTTPServer, SimpleHTTPRequestHandler
-from ssl import get_default_verify_paths, SSLContext, PROTOCOL_TLSv1_1, PROTOCOL_TLSv1_2
+from ssl import SSLContext, PROTOCOL_TLSv1_1, PROTOCOL_TLSv1_2
 from typing import Callable
 
 import pytest
@@ -105,17 +105,6 @@ def test_tls_v1_2():
 
     ssl_context = service.http_adapter.poolmanager.connection_pool_kw.get("ssl_context")
     assert ssl_context is not None
-    # In some cases (especially in Ubuntu containers that we use for testing on Travis)
-    # the default CA certificates are stored in a different place, so let's try to
-    # load those before making the final decision for this test case.
-    if len(ssl_context.get_ca_certs()) == 0:
-        try:
-            default_ca_path = get_default_verify_paths().capath
-            ssl_context.load_verify_locations(os.path.join(default_ca_path, 'ca-certificates.crt'))
-        except:
-            # Errors are ignored, let's jump straight to the assertion.
-            pass
-
     assert len(ssl_context.get_ca_certs()) > 0
 
     prepped = service.prepare_request('GET', url='/status')