'verify' with custom ca bundle

It seems that currently, if 'verify' is set to the filename of a ca_bundle, a certificate that doesn't match it **will be accepted without SSLError** if it matches the global bundle. This is counter-intuitive, unclear in the documentation and prevents users from actually overriding the ca_bundle with their own.

Example:

```
openssl req -nodes -x509 -days 3650 \
    -newkey rsa:2048 -keyout ca-key.pem \
    -out ca-cert.pem \
    -subj "/C=US/ST=New York/L=New York/O=remram.fr/CN=ca.remram.fr"
python -c "import requests; print(requests.get('https://google.com/', verify='ca-cert.pem'))"
```

My version is 2.4.3, on OS X.


``` python
~/sandbox/requests (master) python
Python 2.7.8 (default, Aug 24 2014, 21:26:19)
[GCC 4.2.1 Compatible Apple LLVM 5.1 (clang-503.0.40)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> r = requests.get('https://google.com', verify='../urllib3/dummyserver/certs/client_bad.pem')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "requests/api.py", line 60, in get
    return request('get', url, **kwargs)
  File "requests/api.py", line 49, in request
    return session.request(method=method, url=url, **kwargs)
  File "requests/sessions.py", line 457, in request
    resp = self.send(prep, **send_kwargs)
  File "requests/sessions.py", line 569, in send
    r = adapter.send(request, **kwargs)
  File "requests/adapters.py", line 420, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno 1] _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
>>> r = requests.get('https://google.com', verify='../urllib3/dummyserver/certs/client.pem')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "requests/api.py", line 60, in get
    return request('get', url, **kwargs)
  File "requests/api.py", line 49, in request
    return session.request(method=method, url=url, **kwargs)
  File "requests/sessions.py", line 457, in request
    resp = self.send(prep, **send_kwargs)
  File "requests/sessions.py", line 569, in send
    r = adapter.send(request, **kwargs)
  File "requests/adapters.py", line 420, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno 1] _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
```

I can't reproduce this. (If it isn't obvious, I have requests and urllib3 cloned next to each other and I'm using the self-signed certificates in the bundles in `urllib3/dummyserver/certs`.)


On master (v2.4.3-28-g122c92e), with the same certificate you mention (from urllib3 git):

```
$ git clone git@github.com:shazow/urllib3.git
...
$ git clone git@github.com:kennethreitz/requests.git
...
$ virtualenv venv27
New python executable in venv27/bin/python
Installing setuptools, pip...done.
$ . venv27/bin/activate
(venv27)$ cd requests
(venv27)$ git describe
v0.6.4-3028-g122c92e
(venv27)$ git describe --tags
v2.4.3-28-g122c92e
(venv27)$ python
Python 2.7.5 (default, Mar  9 2014, 22:15:05) 
[GCC 4.2.1 Compatible Apple LLVM 5.0 (clang-500.0.68)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> requests.get('https://google.com/', verify='../urllib3/dummyserver/certs/client_bad.pem')
<Response [200]>
>>> ^D
```

I'm really not sure what else to tell you...


Interestingly, using Python 2.7.8 from macports (with `virtualenv -p /opt/local/bin/python`, I get the same results as you. Could this be a Python or OpenSSL bug, or a patch from Apple?

```
requests.exceptions.SSLError: [Errno 1] _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
```


I'm using Python 2.7.8 from homebrew. I think it's linked against openssl 1.0.1i on my laptop. It could be a difference in the version of openssl in use and it could be a difference in the version of openssl Apple ships versus an actually up-to-date one. Either way, this isn't the fault of requests and there's no way we can "fix" this.


On #python:

> 23:52 < _habnabit> Remram, apple has a custom-patched SSL, yes
> 23:53 < _habnabit> Remram, apple's OpenSSL does keychain cert verification
> 23:53 < _habnabit> Remram, https://hynek.me/articles/apple-openssl-verification-surprises/

Although this looks very serious, you are right, there is probably nothing to be done in requests. Perhaps you could mention this somewhere in the documentation, since requests will not behave as expected on OS X.


The requests documentation is not the place for these bizarre edgecases. Blog posts are. =)


I disagree. This is a security issue, affecting one major feature of requests (certificate validation, which Python's stdlib skips) on one major platform (we're both using it!). It should definitely be apparent to users who are about to use the verify='...' feature.


The correct way to phrase this security issue is that the system OpenSSL should _never_ be used on OS X. It's wildly out of date and hopelessly insecure. That's a warning I can see us putting in the documentation, but in a more general form.


I'd be happy with this. I had no idea.