The Fix
Upgrade to version 0.7.3 or later.
Based on closed encode/httpx issue #354 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -7,7 +7,9 @@
import pytest
import trustme
+from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.serialization import (
+ load_pem_private_key,
Option A — Upgrade to fixed release\nUpgrade to version 0.7.3 or later.\nWhen NOT to use: Do not use this fix if you need to test behavior with verify=False.\n\n
Why This Fix Works in Production
- Trigger: Change trustme.CA() usage to mimic real-life
- Mechanism: Changes the usage of trustme.CA() to allow TLS verifications within the unit test suite, ensuring that HTTPS tests use the CA's PEM for verification.
- Why the fix works: Changes the usage of trustme.CA() to allow TLS verifications within the unit test suite, ensuring that HTTPS tests use the CA's PEM for verification. (first fixed release: 0.7.3).
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Production symptom (often without a traceback): Change trustme.CA() usage to mimic real-life
Proof / Evidence
- GitHub issue: #354
- Fix PR: https://github.com/encode/httpx/pull/357
- First fixed release: 0.7.3
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.85
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.75
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“@sethmlarson this looks (hopefully) straightforward. I can give it a go as my first issue if you like?”
“That would be awesome! Reach out if you run into any roadblocks or have questions. :)”
Failure Signature (Search String)
- Change trustme.CA() usage to mimic real-life
- We need to change our usage of `trustme.CA()` to allow doing TLS verifications within the unit test suite.
Copy-friendly signature
Failure Signature
-----------------
Change trustme.CA() usage to mimic real-life
We need to change our usage of `trustme.CA()` to allow doing TLS verifications within the unit test suite.
Error Message
Signature-only (no traceback captured)
Error Message
-------------
Change trustme.CA() usage to mimic real-life
We need to change our usage of `trustme.CA()` to allow doing TLS verifications within the unit test suite.
What Broke
Unit tests were failing due to improper TLS verification settings.
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
Upgrade to version 0.7.3 or later.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/encode/httpx/pull/357
First fixed release: 0.7.3
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- Do not use this fix if you need to test behavior with verify=False.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 0.7.3 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.