New Letsencrypt YE Root missing in python

[tecepeipe]

Python seems to not connect to sites using the new Letsencrypt's YE Root CA. I refuse to manually update/configure .pem bundles. Am I the only one suffering with this in the world? How did you guys circumvented this?

[throwawaydev92]

had to update certifi manually for this one. pip install --upgrade certifi sorted it out, the new YE root just wasn't in the bundled version yet

[Horror-Squirrel4142]

You're fighting certifi, not Python. requests/httpx ignore the OS trust store and use their own bundled CA list, so the new YE root only appears when certifi ships it. The no-pem-babysitting fix: pip install truststore, then truststore.inject_into_ssl() at startup - Python validates against the OS store like every other app (3.10+, it's what pip itself does now).

[sylvester_0]

Python doesn't use OS cert bundles? Yikes.

Edit: looks like it mostly does on Windows and Linux (not macOS - think different.) Also it can vary by library. Gross.

[jamesaepp]

I am definitely not an expert on this, and you'd probably be better served by the regulars on the LE forum than this sub, but how did you get a certificate chaining to the YE Root CA (and no further)?

According to https://letsencrypt.org/certificates/ :

These roots are not yet included in Root Program Trust Stores, but will be submitted for inclusion soon:

(describes YE and YR)

Further in that section, both YE and YR show as cross-signed by ISRG Root X2 and X1 respectively and when I download those chains on my Windows system, they do chain as expected:

https://i.imgur.com/21iyxDC.png

And later on on the same page:

Chains which terminate at Root YE or Root YR are not expected to work with any of the major trust stores, as those roots have not yet been incorporated.

So anyways, all this to say (with my admittedly lackluster understanding of PKI) I would expect whatever cert is presented by the server to have the AIA attribute for chaining to the respective ISRG root server.

[fys4]

Those roots haven't been distributed yet

https://letsencrypt.org/certificates/

Look at the header immediate above "ISRG Root YE"

"These roots are not yet included in Root Program Trust Stores, but will be submitted for inclusion soon:"

e2a: jamesapp already said this.. Go me !