version 2.18.4 server certificate verify fails with CA cert folder

I created a Python 3.5.2 virtual environment, installed requests with pip3, followed the documentation to set up an "ssl" folder with all the signing certificates for https://www.umich.edu/.

Then I run a simple test script (see Reproduction Steps below) in python interactive mode.

## Expected Result

A normal response with status 200 is expected -- which is what I get outside the virtual environment, where in Ubuntu 16.04, the `python-requests` package pulls in version 2.9.1.

When I remove the `python-requests` package (2.9.1) and used pip3 to install version 2.18.4, I get the same cert verification failure.

I am able to work around the issue by concatenating the CA certs I need onto the end of `.../lib/python3.5/site-packages/certifi/cacert.pem` file installed in the virtual environment.

## Actual Result

A stack dump with CERTIFICATE_VERIFY_FAILED error:

```
>>> requests.get('https://www.umich.edu', verify='./ssl')
Traceback (most recent call last):
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/urllib3/connectionpool.py", line 601, in urlopen
    chunked=chunked)
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/urllib3/connectionpool.py", line 346, in _make_request
    self._validate_conn(conn)
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/urllib3/connectionpool.py", line 850, in _validate_conn
    conn.connect()
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/urllib3/connection.py", line 326, in connect
    ssl_context=context)
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/urllib3/util/ssl_.py", line 329, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/lib/python3.5/ssl.py", line 377, in wrap_socket
    _context=self)
  File "/usr/lib/python3.5/ssl.py", line 752, in __init__
    self.do_handshake()
  File "/usr/lib/python3.5/ssl.py", line 988, in do_handshake
    self._sslobj.do_handshake()
  File "/usr/lib/python3.5/ssl.py", line 633, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:645)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/requests/adapters.py", line 440, in send
    timeout=timeout
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/urllib3/connectionpool.py", line 639, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/urllib3/util/retry.py", line 388, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='www.umich.edu', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:645)'),))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/requests/api.py", line 72, in get
    return request('get', url, params=params, **kwargs)
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/requests/api.py", line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/requests/sessions.py", line 508, in request
    resp = self.send(prep, **send_kwargs)
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/requests/sessions.py", line 618, in send
    r = adapter.send(request, **kwargs)
  File "/home/weiwang/oss/venv/netopy/lib/python3.5/site-packages/requests/adapters.py", line 506, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='www.umich.edu', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:645)'),))
```

## Reproduction Steps

```python
import requests
requests.get('https://www.umich.edu', verify='./ssl')
```

## System Information

    $ python -m requests.help

```
$ python -m requests.help
{
  "chardet": {
    "version": "3.0.4"
  },
  "cryptography": {
    "version": ""
  },
  "idna": {
    "version": "2.6"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.5.2"
  },
  "platform": {
    "release": "4.4.0-36-generic",
    "system": "Linux"
  },
  "pyOpenSSL": {
    "openssl_version": "",
    "version": null
  },
  "requests": {
    "version": "2.18.4"
  },
  "system_ssl": {
    "version": "1000207f"
  },
  "urllib3": {
    "version": "1.22"
  },
  "using_pyopenssl": false
}
```

This command is only available on Requests v2.16.4 and greater. Otherwise,
please provide some basic information about your system (Python version,
operating system, &c).

Hi there! Thanks for opening this issue. Unfortunately, it seems this is a request for help instead of a report of a defect in the project. Please use [StackOverflow](https://stackoverflow.com) for general usage questions instead and only report defects here. Let me give you a few hints though

> I created a Python 3.5.2 virtual environment, installed requests with pip3, followed the documentation to set up an "ssl" folder with all the signing certificates for https://www.umich.edu/.
> [snip]
> I am able to work around the issue by concatenating the CA certs I need onto the end of .../lib/python3.5/site-packages/certifi/cacert.pem file installed in the virtual environment.
> ```
> >>> requests.get('https://www.umich.edu', verify='./ssl')
> [snip]
> ```

It sounds like you're throwing some files in `./ssl` but you've realized appending them to the `cacert.pem` file works. I wonder if you've tried making the files in `./ssl` into a pem file and passing that instead.


I'm having the same issue using a ca_path with as defined by openssl. requests throws an error and crashes.
I've inspected my backtrace and the ca_cert_dir is set in the urlib connection. i've tried to use the appropriate root cert inside the capath and the request works fine.
```
`my_response = self.__session.get(self._address)
     30         if not __my_response.ok:
     31             __my_response.raise_for_status()

/usr/lib/python3.7/site-packages/requests/sessions.py in get(self, url, **kwargs)
    544 
    545         kwargs.setdefault('allow_redirects', True)
--> 546         return self.request('GET', url, **kwargs)
    547 
    548     def options(self, url, **kwargs):

/usr/lib/python3.7/site-packages/requests/sessions.py in request(self, method, url, params, data, headers, cookies, files, auth, timeout, allow_redirects, proxies, hooks, stream, verify, cert, json)
    531         }
    532         send_kwargs.update(settings)
--> 533         resp = self.send(prep, **send_kwargs)
    534 
    535         return resp

/usr/lib/python3.7/site-packages/requests/sessions.py in send(self, request, **kwargs)
    644 
    645         # Send the request
--> 646         r = adapter.send(request, **kwargs)
    647 
    648         # Total elapsed time of the request (approximately)

/usr/lib/python3.7/site-packages/requests/adapters.py in send(self, request, stream, timeout, verify, cert, proxies)
    512             if isinstance(e.reason, _SSLError):
    513                 # This branch is for urllib3 v1.22 and later.
--> 514                 raise SSLError(e, request=request)
    515 
    516             raise ConnectionError(e, request=request)

SSLError: HTTPSConnectionPool(host='myserver.com', port=443): Max retries exceeded with url: /fixme/007 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))
> /usr/lib/python3.7/site-packages/requests/adapters.py(514)send()
    512             if isinstance(e.reason, _SSLError):
    513                 # This branch is for urllib3 v1.22 and later.
--> 514                 raise SSLError(e, request=request)
    515 
    516             raise ConnectionError(e, request=request)

`
```

this is my backtrace using ipython.

https://invent.kde.org/snippets/172