I'm currently messing around with the Requests module in python, which allows you to specify a SSL cert to use in your request, using the following command
url = r'https://www.google.com' cert_path = r'C:\mystuff\google.crt' requests.get(url, verify=cert_path)
Requests stores its trusted CA's in a PEM file located at python/Lib/site-packages/requests/cacert.pem. If you specify 'verify=True', then it will search cacert.pem.
I'm viewing the Cert for https://www.google.com through Chrome, and it has the following cert path.
GeoTrust Global CA -> Google Internet Authority G2 -> www.google.com
What I find strange is that when I pull out all of the GeoTrust related SSL Certs out of the cacert.pem store, put them into their own GeoTrust.pem, and point requests at that file, the handshake fails.
However, through trial and error, if I remove the very first SSL cert from cacerts.pem, which is "Equifax Secure CA", put it into it's own cert file, and point at that, the request works perfect.
In essence, why is a request using a GeoTrust cert being denied against a url setup with a GeoTrust cert? And why would it work when specifying the Equifax root?
I have also attempted to copy directly from google through chrome the GeoTrust root certificate as Base64, and add that to GeoTrust.pem, but the handshake still fails.
I'm new to this, so any help would be greatly appreciated