diff --git a/httpie/ssl_.py b/httpie/ssl_.py index 6b3ef38cf6..a3c33422ab 100644 --- a/httpie/ssl_.py +++ b/httpie/ssl_.py @@ -77,11 +77,26 @@ def _create_ssl_context( ciphers=ciphers, ssl_version=resolve_ssl_version(ssl_version), # Since we are using a custom SSL context, we need to pass this - # here manually, even though it’s also passed to the connection + # here manually, even though it's also passed to the connection # in `super().cert_verify()`. cert_reqs=ssl.CERT_REQUIRED if verify else ssl.CERT_NONE ) - ensure_default_certs_loaded(ssl_context) + # Ensure default certificates are loaded for proper SSL verification + # This addresses https://github.com/httpie/cli/issues/1632 + if verify: + # First try the existing ensure_default_certs_loaded function + ensure_default_certs_loaded(ssl_context) + + # Additional safety check for cases where certificates might not be loaded + # This handles the specific issue where create_urllib3_context() + # creates a context with 0 certificates + if hasattr(ssl_context, 'load_default_certs') and not ssl_context.get_ca_certs(): + try: + ssl_context.load_default_certs() + except Exception: + # If loading fails, continue with what we have + # This preserves backward compatibility + pass return ssl_context @classmethod @@ -106,4 +121,4 @@ def _is_key_file_encrypted(key_file): # We used to import the default set of TLS ciphers from urllib3, but they removed it. # Instead, now urllib3 uses the list of ciphers configured by the system. # -DEFAULT_SSL_CIPHERS_STRING = ':'.join(HTTPieHTTPSAdapter.get_default_ciphers_names()) +DEFAULT_SSL_CIPHERS_STRING = ':'.join(HTTPieHTTPSAdapter.get_default_ciphers_names()) \ No newline at end of file