Name of Failure:

test_validation_with_system_ca_certs fails on Windows (test-win64 / pyopenssl-win64)

Link to task:

mongo_python_driver_test_win64_..._6a4ece5b1122c800079590be

Context of when and why the failure occurred:

Pre-existing since 2026-06-03, unrelated to PYTHON-5040 (ruled out by testing). get_ssl_context() calls ctx.load_default_certs(), which on Windows merges the real OS CA/ROOT stores alongside the test CA set via SSL_CERT_FILE, triggering a spurious signature-verification failure. Confirmed via diagnostic patch #10604: loading only SSL_CERT_FILE instead of load_default_certs() fixes it.

Fix: in pymongo/ssl_support.py's get_ssl_context(), when SSL_CERT_FILE/SSL_CERT_DIR is set, call load_verify_locations() directly instead of load_default_certs().

Details: gist

Stack trace:

pymongo.errors.ServerSelectionTimeoutError: server:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate signature failure (_ssl.c:1010)