[Python] How to verify only using the given CA file, not against all trusted CAs on the system?

I have a Python package that uses Requests. I create a Session object with verify=[A CA File]. It appears that Requests will use this, plus any system-defined certificates, to verify the connection. Is there any way to disable this behavior?

One of my clients does not have the same trust store as I do, and on their system the connection fails. I already know that this is because the certificate I am explicitly using isn't correct, but since that fact was masked in my program due to the correct cert being in my trust store, I didn't know. I'd like to be able to test properly next time.

Edit: Here's a simple proof:

Generate a random self-signed cert, or else just grab one from a random site on the internet. Then use it in the second command below.

import requests

r = requests.get("https://google.com", verify=True, timeout=10)
r.raise_for_status()


r = requests.get("https://google.com", verify="cert.pem", timeout=10)
r.raise_for_status()

print("Everything worked!")


No matter what you pass in, Google will be in your PC's trust store, and it'll work.

Edit: If someone can get this working using httpx, that would work fine too.

Continue reading...