Repository: praw-dev/praw

Issue:
PRAW does not work with custom SSL cert bundle
Because of the proxy I'm using, I need to use a custom SSL cert bundle. Normally using the requests library, this is achievable in one of 2 ways:

Explicitly setting `verify` to the path of the bundle:

```
requests.get('https://google.com', verify='/path/to/cacert.pem')
```

Or setting an environment variable so that all requests use it:

```
export REQUESTS_CA_BUNDLE='/path/to/cacert.pem'

requests.get('https://google.com')
```

The environment variable is preferred because this allows the requests library to work when called from other packages that I did not write.

However, this does not work with PRAW. The problem I see is severalfold:

Using `Session.request` from requests library gets the environment variable properly through the `merge_environment_settings` method:

https://github.com/kennethreitz/requests/blob/fb014560611f6ebb97e7deb03ad8336c3c8f2db1/requests/sessions.py#L461
https://github.com/kennethreitz/requests/blob/fb014560611f6ebb97e7deb03ad8336c3c8f2db1/requests/sessions.py#L617-L629

But this code is never reached since PRAW builds its own request and uses Session.send which does not pull the environment variable:

https://github.com/praw-dev/praw/blob/3902dc24b0f42e487e26481aae46352806e3e6a8/praw/handlers.py#L101-L102

PRAW does support a setting for `validate_certs` which gets passed along as the `verify` parameter to requests library. The issue here is that PRAW only allows a boolean. Setting this variable to the path of a `cacert.pem` file evaluates to False and turns off SSL verification:

https://github.com/praw-dev/praw/blob/3902dc24b0f42e487e26481aae46352806e3e6a8/praw/__init__.py#L222-L223

There are a couple ways to solve this that I can think of. I would be glad to help out with a fix if that is something that is desirable.



Discussion:
Thanks for reporting. We would love it if you could contribute a fix.

> PRAW builds its own request and uses Session.send which does not pull the environment variable

That's a bummer. I'm hopefully you can figure something to work. If you can it would be great to make a PR to both master and the PRAW4 branch which have diverged on how this is actually implemented. The change to PRAW4 will likely require also making a PR to https://github.com/praw-dev/prawcore -- although we don't use `Session.send` anymore, so maybe it'll just work with the environment variables in PRAW4.


Resolving patch:
diff --git a/praw/handlers.py b/praw/handlers.py
--- a/praw/handlers.py
+++ b/praw/handlers.py
@@ -98,8 +98,12 @@ def request(self, request, proxies, timeout, verify, **_):
         arguments intended for the cache handler.
 
         """
-        return self.http.send(request, proxies=proxies, timeout=timeout,
-                              allow_redirects=False, verify=verify)
+        settings = self.http.merge_environment_settings(
+            request.url, proxies, False, verify, None
+        )
+        return self.http.send(request, timeout=timeout, allow_redirects=False,
+                              **settings)
+
 RateLimitHandler.request = RateLimitHandler.rate_limit(
     RateLimitHandler.request)
 


Test patch: