Summary

Avoid building a throwaway SSL context in the HTTPS cert handler.

Review Request #15216 — Created Aug. 4, 2026 and submitted Aug. 4, 2026, 2:39 p.m.

Information

Owner

david

Repository

Review Board

Branch

release-8.x

Bugs

Depends On

Reviewers

Groups

reviewboard

People

Description

On Python 3.12+, urllib.request.HTTPSHandler.__init__ builds a default
SSL context when one isn't passed in, loading the system CA store in the
process. CertificateVerificationHTTPSHandler didn't pass one, so every
handler we construct pays for a context that https_open immediately
throws away and replaces with the managed one from the certificate
manager. Handlers are built per-request, so this isn't free.

This also breaks the cert unit tests, which capture every context
created during a request and then assert against the first one. With the
extra context in the list, they inspect the throwaway instead of ours.

The handler now passes a cheap placeholder context to the parent, which
https_open replaces as before.

Testing Done

Ran unit tests on Python 3.10 and 3.12

Commits

Summary	ID
Avoid building a throwaway SSL context in the HTTPS cert handler. On Python 3.12+, `urllib.request.HTTPSHandler.__init__` builds a default SSL context when one isn't passed in, loading the system CA store in the process. `CertificateVerificationHTTPSHandler` didn't pass one, so every handler we construct pays for a context that `https_open` immediately throws away and replaces with the managed one from the certificate manager. Handlers are built per-request, so this isn't free. This also breaks the cert unit tests, which capture every context created during a request and then assert against the first one. With the extra context in the list, they inspect the throwaway instead of ours. The handler now passes a cheap placeholder context to the parent, which `https_open` replaces as before. Testing Done: Ran unit tests.	vlqnutxswvnwkqoumkrvzsspqssmrmmv

Summary

Avoid building a throwaway SSL context in the HTTPS cert handler.

On Python 3.12+, `urllib.request.HTTPSHandler.__init__` builds a default SSL context when one isn't passed in, loading the system CA store in the process. `CertificateVerificationHTTPSHandler` didn't pass one, so every handler we construct pays for a context that `https_open` immediately throws away and replaces with the managed one from the certificate manager. Handlers are built per-request, so this isn't free. This also breaks the cert unit tests, which capture every context created during a request and then assert against the first one. With the extra context in the list, they inspect the throwaway instead of ours. The handler now passes a cheap placeholder context to the parent, which `https_open` replaces as before. Testing Done: Ran unit tests.

vlqnutxswvnwkqoumkrvzsspqssmrmmv

flake8 passed.

JSHint passed.

Ship it!

```
Ship It!
```

Status:: Completed
Change Summary:: Pushed to release-8.x (f86fc67)