Httpx 0.28.1 ignores the cert parameter when verify is string.

[gtsystem]

Hi,
until httpx 0.27.1 I was able to combine verify and cert parameters as follow:

cert = ("path/to/cert.pem", "path/to/cert.key")
r = httpx.get("https://example.org", verify="path/to/client.pem", cert=cert)

But now the behavior change as the certicate chain is not updated.
This is visible from the code https://github.com/encode/httpx/blob/0.28.1/httpx/_config.py#L54

def create_ssl_context(
    verify: ssl.SSLContext | str | bool = True,
    cert: CertTypes | None = None,
    trust_env: bool = True,
) -> ssl.SSLContext:
   ...

    if verify is True:
       ctx = ...
    elif verify is False:
        ctx = ...
    elif isinstance(verify, str):  # pragma: nocover
        ...
        if os.path.isdir(verify):
            return ssl.create_default_context(capath=verify) # <--- returns without calling load_cert_chain
        return ssl.create_default_context(cafile=verify)  # <--- returns without calling load_cert_chain
    else:
        ctx = verify

    if cert:  # pragma: nocover
        message = (
            "`cert=...` is deprecated. Use `verify=<ssl_context>` instead,"
            "with `.load_cert_chain()` to configure the certificate chain."
        )
        warnings.warn(message, DeprecationWarning)
        if isinstance(cert, str):
            ctx.load_cert_chain(cert)
        else:
            ctx.load_cert_chain(*cert)   # <--- this line is never reached

    return ctx

I understand that setting verify to string is already deprecated and I may just going to fix the code from my side, but I have the feeling that this is a bug, as this is the only combination using return ... instead of ctx = ....

Related issue gtsystem/lightkube#78

[0xamlab]

Confirmed. The early returns for verify=<str> skip the cert handling that follows.

Measured on httpx 0.28.1: monkeypatching SSLContext.load_cert_chain shows it is invoked once for verify=True and once for verify=False, but zero times for verify=<path-to-ca-file>. The deprecation warning for cert=... is still emitted in all three cases, so the cert is silently dropped when verify is a string.

The gap is in httpx/_config.py:53-54: both branches return a fresh ssl.create_default_context(...) instead of assigning to ctx, so execution never reaches the if cert: block at httpx/_config.py:58-67.

Workaround: build the context yourself and load the cert chain before passing it to httpx:

ctx = ssl.create_default_context(cafile="path/to/ca.pem")
ctx.load_cert_chain("path/to/cert.pem", "path/to/key.pem")
r = httpx.get("https://example.org", verify=ctx)

[Kilo59]

This repo has become very inactive.
I would suggest moving to httpx2 (an active fork of httpx)

https://pydantic.dev/docs/httpx2/get-started/