From 61ec7264efd5791d4ab7baf7d4a6416367367c44 Mon Sep 17 00:00:00 2001
From: Dor-bl <59066376+Dor-bl@users.noreply.github.com>
Date: Mon, 10 Aug 2026 06:34:24 +0000
Subject: [PATCH] fix(service): secure Appium service TLS verification

Enforce TLS verification when the Appium service URL uses HTTPS.
This updates `is_service_listening` to pass `cert_reqs='CERT_REQUIRED'`
to `urllib3.PoolManager`. It also optionally passes the `certifi` CA
bundle if it is available in the environment. Also fixes type annotations for `_ca_certs` to prevent mypy CI failures.
---
 appium/webdriver/appium_service.py | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/appium/webdriver/appium_service.py b/appium/webdriver/appium_service.py
index 15ed1f77..19dc2b6c 100644
--- a/appium/webdriver/appium_service.py
+++ b/appium/webdriver/appium_service.py
@@ -22,6 +22,12 @@
 
 from selenium.webdriver.remote.remote_connection import urllib3
 
+try:
+    import certifi
+
+    _ca_certs: str | None = certifi.where()
+except ImportError:
+    _ca_certs = None
 DEFAULT_HOST = '127.0.0.1'
 DEFAULT_PORT = 4723
 STARTUP_TIMEOUT_MS = 60000
@@ -208,7 +214,10 @@ def is_service_listening(url: str, timeout: float = 5, custom_validator: Callabl
         True if Appium server is running before the timeout
     """
     time_started_sec = time.perf_counter()
-    conn = urllib3.PoolManager(timeout=1.0)
+    pool_kwargs: dict[str, Any] = {'timeout': 1.0, 'cert_reqs': 'CERT_REQUIRED'}
+    if _ca_certs:
+        pool_kwargs['ca_certs'] = _ca_certs
+    conn = urllib3.PoolManager(**pool_kwargs)
     while time.perf_counter() < time_started_sec + timeout:
         if custom_validator is not None:
             custom_validator()