[Python-Dev] PEP476: Enabling certificate validation by default

[Christian Heimes]

On 19.09.2014 18:53, Alex Gaynor wrote:
> Hi all,
> 
> I've just updated the PEP to reflect the API suggestions from Nick, and the
> fact that the necessary changes to urllib were landed.
> 
> I think this is ready for pronouncement, Guido?

There is still the issue with SSL_CERT_DIR and SSL_CERT_FILE on Windows
and Apple's OpenSSL builds on OSX. I've opened a bug report
http://bugs.python.org/issue22449

tl;dr
On Windows SSL_CERT_DIR and SSL_CERT_FILE are simply ignored by
SSLContext.load_verify_locations.
On OSX Apple's Trust Evaluation Agent adds certs behind the scene.