title: Why python requests not use the system ssl cert by default?
body: <p><strong>Background:</strong></p>
  <p>I'm working on <code>Ubuntu 18.04.1 LTS</code>, using next to install the self-signed certs:</p>
  <pre><code>$ cp -rf my.crt /usr/local/share/ca-certificates/
  $ update-ca-certificates
  </code></pre>
  <p>Everything works fine, because now I could use next to visit my web successfully:</p>
  <pre><code>$ curl https://example.com
  </code></pre>
  <p><strong>Problem:</strong></p>
  <p>However, when I use python3 <code>requests</code> to visit, it reports next error:</p>
  <pre><code>&gt;&gt;&gt; requests.get(&quot;https://example.com&quot;)
  Traceback (most recent call last):
    File &quot;/usr/local/lib/python3.6/dist-packages/urllib3/connectionpool.py&quot;, line 706, in urlopen
      chunked=chunked,
    File &quot;/usr/local/lib/python3.6/dist-packages/urllib3/connectionpool.py&quot;, line 382, in _make_request
      self._validate_conn(conn)
    File &quot;/usr/local/lib/python3.6/dist-packages/urllib3/connectionpool.py&quot;, line 1010, in _validate_conn
      conn.connect()
    File &quot;/usr/local/lib/python3.6/dist-packages/urllib3/connection.py&quot;, line 421, in connect
      tls_in_tls=tls_in_tls,
    File &quot;/usr/local/lib/python3.6/dist-packages/urllib3/util/ssl_.py&quot;, line 429, in ssl_wrap_socket
      sock, context, tls_in_tls, server_hostname=server_hostname
    File &quot;/usr/local/lib/python3.6/dist-packages/urllib3/util/ssl_.py&quot;, line 472, in _ssl_wrap_socket_impl
      return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
    File &quot;/usr/lib/python3.6/ssl.py&quot;, line 407, in wrap_socket
      _context=self, _session=session)
    File &quot;/usr/lib/python3.6/ssl.py&quot;, line 817, in __init__
      self.do_handshake()
    File &quot;/usr/lib/python3.6/ssl.py&quot;, line 1077, in do_handshake
      self._sslobj.do_handshake()
    File &quot;/usr/lib/python3.6/ssl.py&quot;, line 689, in do_handshake
      self._sslobj.do_handshake()
  ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:847)
  </code></pre>
  <p><strong>Additional:</strong></p>
  <p>But, if I explicitly specify the crt, it works successfully:</p>
  <pre><code>&gt;&gt;&gt; requests.get(&quot;https://example.com&quot;, verify='/etc/ssl/certs/ca-certificates.crt')
  &lt;Response [200]&gt;
  </code></pre>
  <p><strong>Question:</strong></p>
  <p>I'm using a third-party code, which means I can't change the python code.</p>
  <p>So, my question is: why python requests not default to find <code>verify</code> in <code>/etc/ssl/certs/ca-certificates.crt</code>? It's the default certification on ubuntu I think, as <code>curl</code> successfully find this by default...</p>
  <p>And, if possible I could set any variable with <code>export</code> which outside of python code, then python requests will default to find the certification?</p>