`SSL_CERT_FILE` and `SSL_CERT_DIR` environment variables are ignored

[jam-re]

Bug report

Bug description:

Hello,

Since Python 3.13, the following environment variables are no longer honored :

• REQUESTS_CA_BUNDLE
• SSL_CERT_FILE
• SSL_CERT_DIR

This is problematic in a corporate environment where a custom CA must be added. This was the only reliable way to make existing code, especially external libraries, trust a custom CA. It was easy and functional, and I don't understand why this feature is no longer here.

In addition, this new behavior is not sufficiently documented, and no workaround is proposed.

Thank you

CPython versions tested on:

3.13

Operating systems tested on:

Windows

[picnixz]

AFAICT, REQUESTS_CA_BUNDLE is not meant to be honored by CPython as it's specific to requests.

In addition, this new behavior is not sufficiently documented, and no workaround is proposed.

See https://stackoverflow.com/questions/79123649/does-python-3-13-ignore-ssl-cert-file-environment-variable-by-design depending on what you need. I'm actually unsure whether it was meant to be officially supported in general.

[itamaro]

According to the labels, this affects 3.14 too, but I couldn't reproduce the issue -- can you provide a repro script?

I tested in my environment now with 3.14 rc2 -- I verified I am getting [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate if I don't set SSL_CERT_FILE
then, when setting SSL_CERT_FILE, everything worked the same, with both 3.12.11 and 3.14.0rc2