Windows CI: system CA cert validation test fails due to OS trust store merge

XMLWordPrintableJSON

    • Type: Build Failure
    • Resolution: Fixed
    • Priority: Major - P3
    • 4.18.0
    • Affects Version/s: None
    • Component/s: TLS/SSL
    • None
    • Python Drivers
    • Not Needed
    • Hide

      1. What would you like to communicate to the user about this feature?
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      3. Which versions of the driver/connector does this apply to?

      Show
      1. What would you like to communicate to the user about this feature? 2. Would you like the user to see examples of the syntax and/or executable code and its output? 3. Which versions of the driver/connector does this apply to?
    • None
    • None
    • None
    • None
    • None
    • None

      Name of Failure:

      test_validation_with_system_ca_certs fails on Windows (test-win64 / pyopenssl-win64)

      Link to task:

      mongo_python_driver_test_win64_..._6a4ece5b1122c800079590be

      Context of when and why the failure occurred:

      Pre-existing since 2026-06-03, unrelated to PYTHON-5040 (ruled out by testing). get_ssl_context() calls ctx.load_default_certs(), which on Windows merges the real OS CA/ROOT stores alongside the test CA set via SSL_CERT_FILE, triggering a spurious signature-verification failure. Confirmed via diagnostic patch #10604: loading only SSL_CERT_FILE instead of load_default_certs() fixes it.

      Fix: in pymongo/ssl_support.py's get_ssl_context(), when SSL_CERT_FILE/SSL_CERT_DIR is set, call load_verify_locations() directly instead of load_default_certs().

      Details: gist

      Stack trace:

      pymongo.errors.ServerSelectionTimeoutError: server:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate signature failure (_ssl.c:1010)

            Assignee:
            Steve Silvester
            Reporter:
            Steve Silvester
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: