How do I manage SSL certificates and verification in urllib3?

urllib3 is a powerful HTTP client for Python that provides many features for making HTTP requests. SSL/TLS certificate verification is important for securely communicating with HTTPS servers to prevent man-in-the-middle attacks. By default, urllib3 attempts to verify the SSL certificate offered by the host.

Here's how to manage SSL certificates and verification in urllib3.

Using Default Certificate Verification

When you make a request using urllib3, it automatically verifies the SSL certificate against a set of default CA certificates:

import urllib3

http = urllib3.PoolManager()
response = http.request('GET', 'https://example.com/')

Disable SSL Certificate Verification

If you're working in a controlled environment or dealing with self-signed certificates, you might need to disable SSL certificate verification. However, this is generally not recommended for production use due to security risks.

import urllib3

# Disable warnings about insecure certificates
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

http = urllib3.PoolManager(cert_reqs='CERT_NONE')
response = http.request('GET', 'https://example.com/', verify=False)

Using a Custom CA Bundle

If you are working with a private CA or a self-signed certificate, you might need to specify a custom CA bundle for verification:

import urllib3

http = urllib3.PoolManager(
    ca_certs='/path/to/custom/cacert.pem'
)
response = http.request('GET', 'https://example.com/')

Using Client Certificates

If the server you are communicating with requires client-side certificates, you can specify them as follows:

import urllib3

http = urllib3.PoolManager(
    cert_file='/path/to/cert.pem',
    key_file='/path/to/key.pem'
)
response = http.request('GET', 'https://example.com/')

Verifying Hostnames

By default, urllib3 also verifies that the SSL certificate returned by the server has a subject that matches the hostname you used in the request. If necessary, host name verification can be disabled (although this would introduce a significant security risk and is not recommended):

import urllib3

http = urllib3.PoolManager(assert_hostname=False)
response = http.request('GET', 'https://example.com/')

Conclusion

It's important to handle SSL certificates and verification correctly to maintain the security of your HTTP communications. urllib3 provides the flexibility to manage SSL certificates and verification to suit your needs, but always ensure that you understand the security implications of disabling or modifying the default behavior.

Remember that disabling SSL certificate verification (CERT_NONE) or hostname checks (assert_hostname=False) should only be done in a secure, controlled environment, and never in a production setting, as it makes the connection vulnerable to attacks.