httpx Httpx ignore `cert` param if setup param

The Fix

Upgrade to version 0.13.0 or later.

Based on closed encode/httpx issue #797 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Open PR/Commit

@@ -101,6 +101,7 @@ def load_ssl_context_no_verify(self) -> ssl.SSLContext:
         context.verify_mode = ssl.CERT_NONE
         context.check_hostname = False
+        self._load_client_certs(context)
         return context

fix.md

Option A — Upgrade to fixed release\nUpgrade to version 0.13.0 or later.\nWhen NOT to use: Do not use this fix in production environments where certificate verification is required.\n\n

Why This Fix Works in Production

Trigger: Client-side certificates cannot be used for authentication with unverified domains, impacting development workflows.
Mechanism: httpx ignores the `cert` parameter when `verify=False`, preventing client-side certificates from being used
Why the fix works: Forwards the `cert` parameter to SSLConf when `verify=False`, allowing client-side certificates for authentication with unverified domains. (first fixed release: 0.13.0).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

httpx ignores the `cert` parameter when `verify=False`, preventing client-side certificates from being used
Production symptom (often without a traceback): Client-side certificates cannot be used for authentication with unverified domains, impacting development workflows.

Proof / Evidence

GitHub issue: #797
Fix PR: https://github.com/encode/httpx/pull/796
First fixed release: 0.13.0
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.80

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“PR https://github.com/encode/httpx/pull/796”

@zueve · 2020-01-30 · source

Failure Signature (Search String)

Client-side certificates cannot be used for authentication with unverified domains, impacting development workflows.

Copy-friendly signature

signature.txt

Failure Signature
-----------------
Client-side certificates cannot be used for authentication with unverified domains, impacting development workflows.

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
Client-side certificates cannot be used for authentication with unverified domains, impacting development workflows.

What Broke

Client-side certificates cannot be used for authentication with unverified domains, impacting development workflows.

Why It Broke

httpx ignores the `cert` parameter when `verify=False`, preventing client-side certificates from being used

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

Upgrade to version 0.13.0 or later.

When NOT to use: Do not use this fix in production environments where certificate verification is required.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/encode/httpx/pull/796

First fixed release: 0.13.0

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not use this fix in production environments where certificate verification is required.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
0.13.0	Fixed

Related Issues

No related fixes found.

Cluster: httpx:configuration-error All hubs All clusters

Related clusters: Data consistency Other Timeout

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

httpx Httpx ignore `cert` param if setup param `verify=False` (Fix)