From 4875364d28212790900824972848461d1d73209c Mon Sep 17 00:00:00 2001
From: cgarling <chris.t.garling@gmail.com>
Date: Sun, 20 Sep 2026 07:26:10 -0400
Subject: [PATCH] Set `SSL_CERT_FILE` with NetworkOptions if unset

Fixes #651 by setting SSL_CERT_FILE from NetworkOptions if unset.
---
 CHANGELOG.md     | 5 +++++
 Project.toml     | 2 ++
 src/C/C.jl       | 1 +
 src/C/context.jl | 4 ++++
 4 files changed, 12 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b7673ae1..4cb3a192 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
 # Changelog
 
 ## Unreleased
+* Set `SSL_CERT_FILE` from `NetworkOptions.ca_roots_path()` before starting the
+  interpreter, unless it is already set. Python's `ssl` can otherwise bind to Julia's
+  `libssl`, whose compiled-in certificate paths do not exist outside the build
+  container, so every HTTPS request from Python fails with
+  `CERTIFICATE_VERIFY_FAILED` ([#651](https://github.com/JuliaPy/PythonCall.jl/issues/651)).
 * Bug fixes.
 
 ## 0.9.36 (2026-09-18)
diff --git a/Project.toml b/Project.toml
index 4942699c..19244178 100644
--- a/Project.toml
+++ b/Project.toml
@@ -9,6 +9,7 @@ Dates = "ade2ca70-3891-5945-98fb-dc099432e06a"
 Libdl = "8f399da3-3557-5675-b5ff-fb832c97cbdb"
 MacroTools = "1914dd2f-81c6-5fcd-8719-6d5c9610ff09"
 Markdown = "d6f4376e-aef5-505a-96c1-9c027394607a"
+NetworkOptions = "ca575930-c2e3-43a9-ace4-1e988b2c1908"
 Preferences = "21216c6a-2e73-6563-6e65-726566657250"
 Serialization = "9e88b42a-f829-5b0c-bbe9-9e923198166b"
 Tables = "bd369af6-aec1-5ad0-b16a-f7cc5008161c"
@@ -21,6 +22,7 @@ Dates = "1"
 Libdl = "1"
 MacroTools = "0.5"
 Markdown = "1"
+NetworkOptions = "1"
 Preferences = "1"
 PyCall = "1"
 Serialization = "1"
diff --git a/src/C/C.jl b/src/C/C.jl
index f7b4e020..6b93c64e 100644
--- a/src/C/C.jl
+++ b/src/C/C.jl
@@ -12,6 +12,7 @@ using UnsafePointers: UnsafePtr
 using Libdl:
     dlpath, dlopen, dlopen_e, dlclose, dlsym, dlsym_e, RTLD_LAZY, RTLD_DEEPBIND, RTLD_GLOBAL
 using Preferences: @load_preference
+using NetworkOptions: NetworkOptions
 
 # do not load CondaPkg if the exe preference is set to something else
 if @load_preference("exe", "@CondaPkg") == "@CondaPkg"
diff --git a/src/C/context.jl b/src/C/context.jl
index ea469ffd..168e7d32 100644
--- a/src/C/context.jl
+++ b/src/C/context.jl
@@ -288,6 +288,10 @@ function init_context()
                 )
             end
 
+            # Ensure Python has a usable set of CA certificates.
+            # See https://github.com/JuliaPy/PythonCall.jl/issues/651
+            get!(ENV, "SSL_CERT_FILE", NetworkOptions.ca_roots_path())
+
             # Start the interpreter and register exit hooks
             Py_InitializeEx(0)
             atexit() do