I recently landed a change for HTTPS handling, but it was an older

version of the branch that was missing fixes for legacy cert handling

and testing.
The backwards-compatibility logic for migrating old PEM data to modern

cert handling had some flaws. It attempted to build a standalone SSL

context, which wasn't safe or compatible with the way that

CertificateVerificationHTTPSHandler worked, causing managed

certificates to be omitted.
Instead of trying to shoe-horn in a custom context, that logic now

builds extra arguments for controlling hostname checks and extra CA data

for the managed context. The handler class takes these and ensures

they're factored in at the right stage.
Hostnames and ports are no longer passed to

CertificateVerificationHTTPSHandler. These weren't available to the

constructor in my prior change, yet were being passed in as part of the

call due to the branch mismatch. These need to be inferred from the URL

in order to get the correct result. This broke several unit tests.
Testing infrastructure has several key fixes:


Cert storage is now cleared between tests. This uses the path state

   for the cert manager instead of manually building paths, like before.


A new CaptureSSLMixin class is added for cert-related test classes

   that set up the appropriate spies needed to perform SSL context

   captures and to do so in a way that handles redirects. It also allows

   for control over the expected response.


Unit tests no longer hard-code stored cert paths, but instead use the

   cert manager's computed state.

Unit tests passed.
Tested with a repository with a legacy self-signed cert. Connected to

my server and saw it worked. The certificate store had the migrated

cert.