Prepared requests do not observe REQUESTS_CA_BUNDLE for SSL verification

With an environment like this (assuming the server's certificate is in whatever bundle being referenced):

```
REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
```

This code block works fine, and it fails expectedly if the certificate is missing from the bundle above.

```
>>> requests.get('https://some-domain')
```

This code block fails, throwing a "certificate verify failed" exception.

```
>>> s = requests.Session()
>>> req = requests.Request('GET', 'https://some-domain')
>>> s.send(req)
```

The first block calls Session.request, which creates a request object then passes it to the session's send method. In Session.request there's logic to try populating the value of verify with REQUESTS_CA_BUNDLE from the environment. Whatever value winds up in verify is then handed off to the session's send method.

In the second block, manually calling the send method doesn't allow for that environment lookup logic to be called. It seems like it'd be more consistent and convenient moving that logic to the adapter's cert_verify method.


Hi @yieldsfalsehood, thanks for raising this issue!

That verification logic is the odd-one-out in `Session.request()`, as it's the only thing that isn't directly related to preparing `PreparedRequest`s.

I think the correct behaviour would be to move the two blocks that handle verification into `Session.send()` instead. It shouldn't go into the Adapter because the Adapter doesn't know about trusting environment variables (and shouldn't). If you have time I encourage you to open a Pull Request, otherwise I'll get around to this later today. =)


Actually, on second thought, I'm no longer convinced we should change this.

I've moved that code in a local copy of Requests, and while everything works fine it just looks _wrong_ to me. `Session.send()` doesn't really mess about with keyword arguments, but this change would do that.

I'm now tempted to say that if you've circumvented `Session.request()` (in order to prepare Requests yourself), you must make sure you do whatever you need from `Session.request()`. In this case, that's merging cookies and getting data from environment variables.

I'm now +0 on this, so I'll wait until we get input from @kennethreitz and @sigmavirus24.


Thanks for the feedback. I'm submit a change and tests to work on this.

Regarding placement, I looked in to the adapter's cert_verify because it seemed the lowest level place to add the lookup logic for that env variable (it's already doing a lookup for the fallback bundle there), but I agree it makes sense to have it where we can check if the trusted environment flag is set. And I agree that if I take control of owning the request object by evading Session.request I am in charge of how I manipulate it (that's the point of being able to create and send the request object manually).

However, I think logic like cookie merging is different than the environment lookup - cookie merging is a higher level process that might need to be customized in the application but the environment lookup will always be the same, which amounts to requiring the end users to do the lookup and pass in the location of the bundle whenever prepared requests are being used. I believe it adds more functionality encapsulating that logic in Requests so that the library behaves the same (in regards to environment lookups) regardless of how requests are issued.


In case you're interested I pushed my test cases up to my fork. They're hackish, but I think they accomplish what they need to.


Hmm, I'm prepared to be convinced by that line of argument. I'd still like at least one of @kennethreitz and @sigmavirus24 to weigh in, but I think that's reasonable. 


I think this was fixed in #2718. Closing for now. If I'm wrong, ping us and we'll reopen it.


@sigmavirus24 this doesn't seem to be fixed, at the very least not in the way that is outlined in this issue. Tested in 2.6.0 (version I was using) and 2.18.1 (latest).

**testcase.py**
```py
from os import environ
from requests import Request, Session


environ['REQUESTS_CA_BUNDLE'] = '/etc/ssl/certs/ca-certificates.crt'

session = Session()
request = Request(method='GET', url='https://debug.lan/health').prepare()

try:
    print(session.send(request, timeout=10))
except Exception as e:
    print(e)

try:
    print(session.get('https://debug.lan/health', timeout=10))
except Exception as e:
    print(e)
```

**output**
```
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)
<Response [200]>
```

@mal We added an API for doing what you need: see #2178.

Aha, thanks @Lukasa, this does the job 👍 

```py
session.send(request, timeout=10,
             **session.merge_environment_settings(request.url, None, None, None, None))
```