httpx How to configure TLS beyond client certificate and CA

The Fix

Upgrade to version 0.7.2 or later.

Based on closed encode/httpx issue #166 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Open PR/Commit

@@ -7,7 +7,7 @@
 
 CertTypes = typing.Union[str, typing.Tuple[str, str], typing.Tuple[str, str, str]]
-VerifyTypes = typing.Union[str, bool]
+VerifyTypes = typing.Union[str, bool, ssl.SSLContext]
 TimeoutTypes = typing.Union[float, typing.Tuple[float, float, float], "TimeoutConfig"]

fix.md

Option A — Upgrade to fixed release\nUpgrade to version 0.7.2 or later.\nWhen NOT to use: Do not use this fix if you require strict SSL configurations without custom contexts.\n\n

Why This Fix Works in Production

Trigger: How to configure TLS beyond client certificate and CA root certs?
Mechanism: The library did not allow passing an SSLContext for custom SSL configurations
Why the fix works: Allows users to configure an SSLConfig instance by passing in an SSLContext object that they've loaded CA certs, ciphers, etc onto. (first fixed release: 0.7.2).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

The library did not allow passing an SSLContext for custom SSL configurations
Production symptom (often without a traceback): How to configure TLS beyond client certificate and CA root certs?

Proof / Evidence

GitHub issue: #166
Fix PR: https://github.com/encode/httpx/pull/215
First fixed release: 0.7.2
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.71

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“I like the ssl argument suggestion personally, I am really excited for this project :) and thanks for taking the time to look into this”

@VeNoMouS · 2019-07-29 · source

“I was thinking about this, maybe we need to either provide a better interface or a recipe for how to do this”

@sethmlarson · 2019-07-29 · source

“My proposed solution was the allow passing an ssl.SSLContext into verify=.... It would get transformed into an SSLConfig object and then still call load_client_cert() if…”

@sethmlarson · 2019-07-29 · source

“I think your biggest hurdle doing that is around here https://github.com/encode/httpx/blob/master/httpx/dispatch/connection.py#L64-L78 due to your logic and how the logic in config is constructed”

@VeNoMouS · 2019-07-29 · source

Failure Signature (Search String)

How to configure TLS beyond client certificate and CA root certs?
Typically in requests you can use a __HTTPAdapter__ to hijack and set the SSL context and define what ciphers to use, how does one go about doing the same in __httpx__?

Copy-friendly signature

signature.txt

Failure Signature
-----------------
How to configure TLS beyond client certificate and CA root certs?
Typically in requests you can use a __HTTPAdapter__ to hijack and set the SSL context and define what ciphers to use, how does one go about doing the same in __httpx__?

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
How to configure TLS beyond client certificate and CA root certs?
Typically in requests you can use a __HTTPAdapter__ to hijack and set the SSL context and define what ciphers to use, how does one go about doing the same in __httpx__?

What Broke

Users were unable to configure SSL settings beyond defaults, leading to potential security issues.

Why It Broke

The library did not allow passing an SSLContext for custom SSL configurations

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

Upgrade to version 0.7.2 or later.

When NOT to use: Do not use this fix if you require strict SSL configurations without custom contexts.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/encode/httpx/pull/215

First fixed release: 0.7.2

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not use this fix if you require strict SSL configurations without custom contexts.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
0.7.2	Fixed

Related Issues

No related fixes found.

Cluster: httpx:configuration-error All hubs All clusters

Related clusters: Data consistency Other Timeout

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

httpx How to configure TLS beyond client certificate and CA root certs? (Fix)