Please respect system (user configured) certs by default

[afazekas]

The project ATM uses certifi and by default ignores system certs (for example company internal CA can be added there).
Please use the system certs, as all other application like curl or urllib3 does by default.

workaround: figure out were the system certs today and pass SSL_CA_BUNDLE.

[javierpena]

There are a few topics to consider here. On the one hand, urllib3 (which is used underneath by dlrnapi_client) recommends certifi as a good cross-platform method to locate the CA cert bundle [1]. We also have the fact that OS-provided python3-certifi packages already patch the library to use the system-level bundle, for example [2] in Fedora. So this is only happening when installing certifi from pip.

On a quick test, setting ca_certs to None in [3] seems to do the right thing and use the system-level certificates, but it would be nice to test on more environments. Personally, I'd prefer to keep certifi at least as an option (maybe using another env var?).

[1] - https://urllib3.readthedocs.io/en/latest/user-guide.html#certificate-verification
[2] - https://src.fedoraproject.org/rpms/python-certifi/blob/rawhide/f/certifi-2020.11.8-use-system-cert.patch
[3] - https://github.com/softwarefactory-project/dlrnapi_client/blob/master/dlrnapi_client/rest.py#L78

[afazekas]

urllib3 was also WORKSFORME me AS IS, only dlrnapi_client had issues.
I would not depend on a dependency which requires patching from the user side in order to work when possible.
If you depend on the distro paching the packages, you can simply expect the distro also patching urllib3 (or it just works).
openssl used at the end anyway which reads the system configs.

ATM SSL_CA_BUNDLE is defined in multiple CI system to take care of certifi wants to use only the mozilla certs,
probably using certifi on system which otherwise does not have any cert is good idea, but in all other cases probably not.

If urllib3 would have failed me alone, I would have open ticket elsewhere.

"setting ca_certs to None" , None probably a better default behavior,
but probably some environment variable or cli arg should be provided for expert usage.

[1] https://github.com/openssl/openssl/blob/master/include/internal/common.h#L65
[2] https://src.fedoraproject.org/rpms/openssl/blob/rawhide/f/openssl.spec#_194