Default certificates are never loaded since version 1.25

[daa]

Opening an HTTPS URL with urllib3>=1.25 results in SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)'))), example to reproduce is following:

import urllib3

http = urllib3.PoolManager()
http.request('GET', 'https://google.com/')

The reason is that default system certificates are never loaded because HTTPSConnection or VerificedHTTPSConnection creates ssl context without loading certificates and passes it to ssl_wrap_socket where default certificates are not loaded too because passed ssl_context is not None. Related lines of code:
src/urllib3/connection.py:

        if self.ssl_context is None:
            self.ssl_context = create_urllib3_context(
                ssl_version=resolve_ssl_version(None),
                cert_reqs=resolve_cert_reqs(None),
            )

        self.sock = ssl_wrap_socket(
            sock=conn,
            keyfile=self.key_file,
            certfile=self.cert_file,
            key_password=self.key_password,
            ssl_context=self.ssl_context,
            server_hostname=self.server_hostname
)

src/urllib3/util/ssl_.py:

    elif ssl_context is None and hasattr(context, 'load_default_certs'):
        # try to load OS default certs; works well on Windows (require Python3.4+)
        context.load_default_certs()

[sethmlarson]

Yep, this looks incorrect. Unfortunately I can't currently think of a good way to handle this and maintain all our interfaces+contracts without calling load_default_certs() inside of HTTPSConnection. cc: @urllib3/maintainers

[sethmlarson]

Basically this boils down to create_urllib3_context() not knowing about ca_cert or ca_cert_dir and so it can't make the call whether to load the default system certs or not. The loading of certs is all done in ssl_wrap_socket(). (imo create_urllib3_context() should probably be the place to load certs)