Summary

Add certificate support for urlopen() calls.

Review Request #14920 — Created March 17, 2026 and submitted April 8, 2026, 1:14 a.m.

Information

Owner

chipx86

Repository

Review Board

Branch

release-7.1.x

Bugs

Depends On

Reviewers

Groups

reviewboard

People

Description

This updates most urlopen() call in the codebase to take in state
from the Certificate Manager, giving them support for managed
certificate verification and mTLS authentication.

By default, urlopen() behaves as it always has, but if there are
custom certificates or CAs configured for the server or Local Site,
they'll automatically pick them up.

The following call sites have been updated:

Security checks
rb-site website communication
WebHooks
Common SCMTool HTTP code

Hosting services have not been updated in this change. That's a larger
piece of work, and is split off into its own change.

Testing Done

Unit tests pass.

Commits

Summary	ID
Add certificate support for urlopen() calls. This updates most `urlopen()` call in the codebase to take in state from the Certificate Manager, giving them support for managed certificate verification and mTLS authentication. By default, `urlopen()` behaves as it always has, but if there are custom certificates or CAs configured for the server or Local Site, they'll automatically pick them up. The following call sites have been updated: * Security checks * rb-site website communication * WebHooks * Common SCMTool HTTP code Hosting services have not been updated in this change. That's a larger piece of work, and is split off into its own change.	46d7cfd77d037f8b1739604061979a534878026e

Summary

Add certificate support for urlopen() calls.

This updates most `urlopen()` call in the codebase to take in state from the Certificate Manager, giving them support for managed certificate verification and mTLS authentication. By default, `urlopen()` behaves as it always has, but if there are custom certificates or CAs configured for the server or Local Site, they'll automatically pick them up. The following call sites have been updated: * Security checks * rb-site website communication * WebHooks * Common SCMTool HTTP code Hosting services have not been updated in this change. That's a larger piece of work, and is split off into its own change.

46d7cfd77d037f8b1739604061979a534878026e

flake8 passed.

JSHint passed.

Ship it!

```
Ship It!
```

Status:: Completed
Change Summary:: Pushed to release-7.1.x (58cb930)