Path: /utilities/util_ssl.py
The util_ssl module provides a function to create an SSLContext configured with the certifi CA certificate bundle, ensuring reliable certificate validation, and falls back to the system default store if certifi cannot be loaded.
Ensure HTTPS requests within Talon use a consistent, up-to-date CA bundle provided by certifi for certificate verification.
Provide a resilient SSLContext creation mechanism that degrades gracefully to the system defaults if certifi is unavailable or fails to load.
Python’s ssl standard library module
certifi package for access to the latest CA bundle
util_logger for warning logs on fallback
| Parameter | Type | Description | Default |
|---|---|---|---|
| None | — | This module exports a single function with no parameters. | — |
from utilities.util_ssl import create_ssl_context
# Create an SSLContext for secure network requests
ssl_context = create_ssl_context()
# Use ssl_context with urllib or other libraries:
# import urllib.request
# response = urllib.request.urlopen('https://example.com', context=ssl_context)
When create_ssl_context is called, the function attempts to locate the certifi CA bundle via certifi.where() and uses it in ssl.create_default_context(cafile=...). If any exception occurs (e.g., certifi not installed or file missing), it logs a warning and creates the SSLContext without specifying cafile, thus relying on the system’s certificate store.
The function catches all exceptions during CA bundle loading, logs a warning via logger.warning with the exception message, and then returns a default SSLContext. No exception is propagated to callers.
Using the certifi bundle ensures an up-to-date set of trusted root certificates. Falling back to the system store may rely on out-of-date or misconfigured certificates; ensure certifi is installed and updated to maintain security.
On successful CA bundle load, no log is emitted. On failure, emits a warning such as:
WARNING util_logger util_ssl.create_ssl_context: Failed to load certifi CA bundle: [error]; falling back to system store
Unit tests should mock certifi.where() to return a valid path and to raise an exception, verifying that create_ssl_context returns an SSLContext in both cases and that the fallback warning is logged.
Author: Raven Development Team