When a CA has its certificates removed from public trust (as happened today), applications don’t always know immediately.

TLDR

Just set SSL_CERT_FILE and you’ll probably be fine:

$ export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

System chain

Most OSs, especially Linux, some with a CA chain, which is updated alongside other package updates. Most software will be configured to use this by default, but some ship with their own (for example, most web browsers).

SSL_CERT_FILE

httpx and Python’s ssl module (used by aiohttp) support SSL_CERT_FILE, as do many other tools, such as curl and anything written in Go. This convention comes from OpenSSL.

requests

requests doesn’t use the system chain, not SSL_CERT_FILE, and instead ships its own via the certifi package. This package needs updating whenever the chain is updated (which fortunately isn’t often). Even if the system chain changes, requests won’t know.

The system chain can be forced using the REQUESTS_CA_BUNDLE environment variable:

$ export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt