using OpenSSL disables certificate checks by default?

[tanmaykm]

• Julia 1.7.3
• HTTP.jl 1.4.1
• MbedTLS.jl 1.1.6
• OpenSSL 1.2.1

When not using OpenSSL, HTTP client requests check for validity of server certificate.

julia> using HTTP

julia> HTTP.get("https://expired.badssl.com/")
ERROR: HTTP.Exceptions.ConnectError("https://expired.badssl.com/", MbedTLS error code -9984: X509 - Certificate verification failed, e.g. CRL, CA or signature check failed)
Stacktrace:
...

julia> HTTP.get("https://expired.badssl.com/"; require_ssl_verification=false)
HTTP.Messages.Response:
"""
HTTP/1.1 200 OK
...

But they don't seem to be doing that when OpenSSL is used:

julia> using OpenSSL

julia> HTTP.SOCKET_TYPE_TLS[] = OpenSSL.SSLStream
SSLStream

julia> HTTP.get("https://expired.badssl.com/")
HTTP.Messages.Response:
"""
HTTP/1.1 200 OK
...