httpx Add support for SSL_CERT_FILE, REQUESTS_CA

The Fix

Upgrade to version 0.7.3 or later.

Based on closed encode/httpx issue #306 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Open PR/Commit

@@ -2,6 +2,12 @@ Environment Variables
 
 The HTTPX library can be configured via environment variables.
+Environment variables are used by default. To ignore environment variables, `trust_env` has to be set `False`.
+There are two ways to set `trust_env` to disable environment variables:
+

fix.md

Option A — Upgrade to fixed release\nUpgrade to version 0.7.3 or later.\nWhen NOT to use: This fix is not applicable if the application does not require CA certificate configuration via environment variables.\n\n

Why This Fix Works in Production

Trigger: Add support for SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and CURL_CA_BUNDLE
Mechanism: The library did not support SSL_CERT_FILE and SSL_CERT_DIR environment variables for CA certificate configuration
Why the fix works: Added support for SSL_CERT_FILE and SSL_CERT_DIR environment variables to configure CA certificates. (first fixed release: 0.7.3).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

The library did not support SSL_CERT_FILE and SSL_CERT_DIR environment variables for CA certificate configuration
Production symptom (often without a traceback): Add support for SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and CURL_CA_BUNDLE

Proof / Evidence

GitHub issue: #306
Fix PR: https://github.com/encode/httpx/pull/307
First fixed release: 0.7.3
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.72

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“One data point: to get async/await support, we switched from requests to httpx for a production service at work today, and we had to change…”

@pquentin · 2020-10-13 · source

“Yeah, I think our starting point should be the PEP - https://www.python.org/dev/peps/pep-0476/#trust-database - Ie”

@lovelydinosaur · 2019-09-03 · source

“Coming back to this again - do we really want all three of those environment variables, or should we be trying to keep things a…”

@lovelydinosaur · 2019-09-03 · source

“I suppose REQUEST_CA_BUNDLE is a Requests-specific environment variable, right? The main argument to keeping it is compatibility with Requests, but now that we’ve got SSL_CERT_FILE…”

@florimondmanca · 2019-09-03 · source

Failure Signature (Search String)

Add support for SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and CURL_CA_BUNDLE
We should check the three environment variables in the order above, as SSL_CERT_FILE is a PEP and a standard whereas the other are products of other projects.

Copy-friendly signature

signature.txt

Failure Signature
-----------------
Add support for SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and CURL_CA_BUNDLE
We should check the three environment variables in the order above, as SSL_CERT_FILE is a PEP and a standard whereas the other are products of other projects.

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
Add support for SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and CURL_CA_BUNDLE
We should check the three environment variables in the order above, as SSL_CERT_FILE is a PEP and a standard whereas the other are products of other projects.

What Broke

Users experienced issues with CA certificate loading when using environment variables.

Why It Broke

The library did not support SSL_CERT_FILE and SSL_CERT_DIR environment variables for CA certificate configuration

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

Upgrade to version 0.7.3 or later.

When NOT to use: This fix is not applicable if the application does not require CA certificate configuration via environment variables.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/encode/httpx/pull/307

First fixed release: 0.7.3

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

This fix is not applicable if the application does not require CA certificate configuration via environment variables.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
0.7.3	Fixed

Related Issues

No related fixes found.

Cluster: httpx:configuration-error All hubs All clusters

Related clusters: Data consistency Other Timeout

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

httpx Add support for SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and CURL_CA_BUNDLE (Fix)