Package: certifi-system-store
certifi-system-store, a certifi hack to use system trust storecertifi-system-storeis a replacement and hack for consumers ofcertifi. It replaces certifi with an alternative implementation that
uses the system trust store on Linux and some BSD distributions.Please be advised that this package is brand new andhighly
experimental. It hasn't been tested in any production environment.InstallationYou absolutelymustrunpython -m certifiafter installing the
package. The command ensures that you have a working system trust store
and patches your current Python environment. It creates or replaces
certifi's dist-info directory with certifi-system-store's dist-info.I recommend that you installcertifi-system-storeand patch first,
then install your packages and requirements.$python-mpipinstallcertifi-system-store
$python-mcertifi
$python-mpipinstallrequestsVerificationThecertificommand ofcertifi-system-storehas an additional
argument--system-store. The argument is not available with standardcertifipackage. You can use the property to verify thatcertifipackage is provided bycertifi-system-store.$python-mvenvvenv
$venv/bin/pipinstallcertifi
$venv/bin/python-mcertifi--system-store
usage:__main__.py[-h][-c]__main__.py:error:unrecognizedarguments:--system-store
$echo$?2$venv/bin/pipinstallcertifi-system-store
$venv/bin/python-mcertifi--system-store
/etc/pki/tls/cert.pem
$echo$?0The command also checks for the presence of a CA cert bundle:$venv/bin/python-mcertifi
Traceback(mostrecentcalllast):...
FileNotFoundError:/etc/ssl/cert.pem,/etc/pki/tls/cert.pem,/etc/ssl/certs/ca-certificates.crt,/etc/ssl/ca-bundle.pem
$echo$?1To check forcertifi-system-storeat runtime:importcertifiifnotgetattr(certifi,"__certifi_system_store__",False):raiseImportError("certifi-system-store is not installed")To depend oncertifi-system-store:# setup.pyfromsetuptoolsimportsetupsetup(...,install_requires=["certifi-system-store ; sys_platform == 'linux' or 'freebsd' in sys_platform","certifi > 3000 ; sys_platform == 'linux' or 'freebsd' in sys_platform","certifi",],)Platform supportSupported platformsMost major Linux distributions and FreeBSD are supported.AlpineDebian-based distributions (Ubuntu, Raspberry Pi OS, Tails, ...)NOTE:Some distributions don't have a system trust store in
their minimal package list. You may have to installca-certificatesmanually, seeDebian bug #960869,Ubuntu bug #1879310.Fedora-based distributions (RHEL, CentOS, CentOS Streams)FreeBSDNOTE:may require manual installation ofca_root_nssOpenSUSEUntested platformscertifi-system-storemay work, but there is no CI for these platforms.ArchLinuxGentooOpenWRTSlackwareVoidLinuxother Linux distributions not based on Debian or FedoraOpenBSDNetBSDUnsupported platformsWindowsmacOSAndroid (has a cert directory but not a PEM bundle)iOSSupported system trust stores/etc/ssl/cert.pemAlpineArchFedora 34+ (seerhbz#1895619)FreeBSD (requiresca_root_nsspackage)OpenWRTRHEL 9/etc/pki/tls/cert.pemCentOS 7, 8Fedora 33 and earlierRHEL 7, 8/etc/ssl/certs/ca-certificates.crtDebian (requiresca-certificatespackage)GentooUbuntu (requiresca-certificatespackage)/etc/ssl/ca-bundle.pemSUSEHow to install custom CA certificatesAlpine$sudocpmy-custom-ca.pem/usr/local/share/ca-certificates/my-custom-ca.crt
$sudoupdate-ca-certificatesArch$sudocpmy-custom-ca.pem/etc/ca-certificates/trust-source/anchors/my-custom-ca.crt
$sudoupdate-ca-trustCentOS, Fedora, RHELStandard PEM or DER-encoded certificates (BEGIN CERTIFICATE)$sudocpmy-custom-ca.pem/etc/pki/ca-trust/source/anchors/
$sudoupdate-ca-trustCertificates with additional trust information
(BEGIN TRUSTED CERTIFICATE)$sudocpmy-custom-ca.pem/etc/pki/ca-trust/source/
$sudoupdate-ca-trustDebian, UbuntuNote: The man pageupdate-ca-certificates(8)mentions that cert
files must have a.crtextension.$sudocpmy-custom-ca.pem/usr/local/share/ca-certificates/my-custom-ca.crt
$sudoupdate-ca-certificatesHow does it work?emptycertifi/cacert.pemto override any existing certifi data.fakecertifi dist-infowith much higher version number than certifi's
default dist-info metadata$venv/bin/pipinstallcertifi-system-store
$ls-l.tox/venv/lib/python3.9/site-packages/
certifi
certifi_system_store-3000.1.dist-info
...
$venv/bin/python-mcertifi-v--system-store
certifi-systemstore3000.0a1
Patchedcertifi.dist-info->certifi_system_store.dist-info
/etc/pki/tls/cert.pem
$ls-l.tox/venv/lib/python3.9/site-packages/
certifi
certifi-3000.1.dist-info->certifi_system_store-3000.1.dist-info
certifi_system_store-3000.1.dist-info
...Special thanksCory BenfieldPradyun GedamWouter Bolsterlee