Certifi

Certifi packages Mozilla’s carefully curated collection of Root Certificates and makes them available to Python applications for validating the trustworthiness of SSL/TLS certificates. Extracted from the Requests project, it exposes the on-disk path to a bundled cacert.pem file so any HTTP client or networking library can verify the identity of TLS hosts without depending on the host operating system’s certificate store.

Because it ships the trust store as a Python package, Certifi gives deployments a reliable and highly portable root of trust that behaves the same across platforms and container images. It is a foundational dependency of the Python HTTP ecosystem, pulled in by libraries such as Requests and httpx.

What You Get

• A bundled cacert.pem file containing Mozilla’s curated root certificate authorities
• A certifi.where() function returning the absolute path to the CA bundle for use with TLS libraries
• A certifi.contents() function returning the PEM bundle as a string
• A python -m certifi command-line entry point that prints the bundle path or contents
• A fully type-annotated package (py.typed) with zero runtime dependencies

Common Use Cases

• Providing the CA bundle that HTTP clients like Requests and httpx use to verify HTTPS connections
• Supplying a portable root of trust to applications running in minimal container images without a system cert store
• Configuring TLS verification for custom socket, urllib3, or SSLContext code by passing certifi.where()
• Guaranteeing consistent certificate validation across development, CI, and production environments

Under The Hood

Architecture - Certifi’s implementation lives almost entirely in certifi/core.py, which returns the location or contents of the bundled cacert.pem. where() lazily resolves the bundle path via importlib.resources and caches it in module globals so extraction (needed under zipimport) happens at most once, registering an atexit cleanup for the resource context manager; contents() reads the PEM as ASCII text. certifi/__init__.py re-exports these two functions, and certifi/__main__.py wraps them in a small argparse CLI.

Tech Stack - The package is pure Python (targeting 3.7+) with zero runtime dependencies, deliberately kept dependency-free because it sits below setuptools and pip in the stack. It branches on sys.version_info to use the modern importlib.resources.files/as_file API on 3.11+ and the older path/read_text API below that. Packaging uses setuptools via a classic setup.py plus a minimal pyproject.toml build-system table, shipping the .pem data and a py.typed marker as package data.

Code Quality - The codebase is tiny and disciplined: functions are fully type-annotated, the version-conditional logic is thoroughly commented to explain the zipimport and cleanup subtleties, and a unittest suite (certifi/tests/test_certify.py) checks that the bundle path exists, that contents contain a PEM certificate block, and that the py.typed marker ships. Coverage is minimal but appropriate for a package whose surface is two functions.

API Design - The public API is about as ergonomic as it gets — two well-named functions, where() and contents(), with no configuration or setup required, plus a python -m certifi CLI for shell use. Integration is a single call (certifi.where()) that drops directly into any TLS library expecting a CA bundle path, which is why it became the de-facto trust store for the Python HTTP ecosystem.