Trying to load a cert, and SSLError: [SSL] PEM lib (_ssl.c:3926) happens

[novitae]

Hello, I am trying to do on the latest version of httpx (0.25.0):

client = httpx.Client(
    base_url="https://gsa.apple.com",
    cert="apple_root.der"
)

and I am getting the following error:

`SSLError: [SSL] PEM lib (_ssl.c:3926)`

---------------------------------------------------------------------------
SSLError                                  Traceback (most recent call last)
[/Users/n/pocs-modules/apple/appleid.ipynb](https://file+.vscode-resource.vscode-cdn.net/Users/n/pocs-modules/apple/appleid.ipynb) Cellule 2 line 1
----> [1](vscode-notebook-cell:/Users/n/pocs-modules/apple/appleid.ipynb#W1sZmlsZQ%3D%3D?line=0) client = httpx.Client(
      [2](vscode-notebook-cell:/Users/n/pocs-modules/apple/appleid.ipynb#W1sZmlsZQ%3D%3D?line=1)     base_url="https://gsa.apple.com/",
      [3](vscode-notebook-cell:/Users/n/pocs-modules/apple/appleid.ipynb#W1sZmlsZQ%3D%3D?line=2)     cert="apple_root.pem"
      [4](vscode-notebook-cell:/Users/n/pocs-modules/apple/appleid.ipynb#W1sZmlsZQ%3D%3D?line=3) )

File [/opt/homebrew/lib/python3.11/site-packages/httpx/_client.py:672](https://file+.vscode-resource.vscode-cdn.net/opt/homebrew/lib/python3.11/site-packages/httpx/_client.py:672), in Client.__init__(self, auth, params, headers, cookies, verify, cert, http1, http2, proxies, mounts, timeout, follow_redirects, limits, max_redirects, event_hooks, base_url, transport, app, trust_env, default_encoding)
    669 allow_env_proxies = trust_env and app is None and transport is None
    670 proxy_map = self._get_proxy_map(proxies, allow_env_proxies)
--> 672 self._transport = self._init_transport(
    673     verify=verify,
    674     cert=cert,
    675     http1=http1,
    676     http2=http2,
    677     limits=limits,
    678     transport=transport,
    679     app=app,
    680     trust_env=trust_env,
    681 )
    682 self._mounts: typing.Dict[URLPattern, typing.Optional[BaseTransport]] = {
    683     URLPattern(key): None
    684     if proxy is None
   (...)
    694     for key, proxy in proxy_map.items()
    695 }
    696 if mounts is not None:

File [/opt/homebrew/lib/python3.11/site-packages/httpx/_client.py:720](https://file+.vscode-resource.vscode-cdn.net/opt/homebrew/lib/python3.11/site-packages/httpx/_client.py:720), in Client._init_transport(self, verify, cert, http1, http2, limits, transport, app, trust_env)
    717 if app is not None:
    718     return WSGITransport(app=app)
--> 720 return HTTPTransport(
    721     verify=verify,
    722     cert=cert,
    723     http1=http1,
    724     http2=http2,
    725     limits=limits,
    726     trust_env=trust_env,
    727 )

File [/opt/homebrew/lib/python3.11/site-packages/httpx/_transports/default.py:133](https://file+.vscode-resource.vscode-cdn.net/opt/homebrew/lib/python3.11/site-packages/httpx/_transports/default.py:133), in HTTPTransport.__init__(self, verify, cert, http1, http2, limits, trust_env, proxy, uds, local_address, retries, socket_options)
    119 def __init__(
    120     self,
    121     verify: VerifyTypes = True,
   (...)
    131     socket_options: typing.Optional[typing.Iterable[SOCKET_OPTION]] = None,
    132 ) -> None:
--> 133     ssl_context = create_ssl_context(verify=verify, cert=cert, trust_env=trust_env)
    135     if proxy is None:
    136         self._pool = httpcore.ConnectionPool(
    137             ssl_context=ssl_context,
    138             max_connections=limits.max_connections,
   (...)
    146             socket_options=socket_options,
    147         )

File [/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:52](https://file+.vscode-resource.vscode-cdn.net/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:52), in create_ssl_context(cert, verify, trust_env, http2)
     46 def create_ssl_context(
     47     cert: typing.Optional[CertTypes] = None,
     48     verify: VerifyTypes = True,
     49     trust_env: bool = True,
     50     http2: bool = False,
     51 ) -> ssl.SSLContext:
---> 52     return SSLConfig(
     53         cert=cert, verify=verify, trust_env=trust_env, http2=http2
     54     ).ssl_context

File [/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:76](https://file+.vscode-resource.vscode-cdn.net/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:76), in SSLConfig.__init__(self, cert, verify, trust_env, http2)
     74 self.trust_env = trust_env
     75 self.http2 = http2
---> 76 self.ssl_context = self.load_ssl_context()

File [/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:88](https://file+.vscode-resource.vscode-cdn.net/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:88), in SSLConfig.load_ssl_context(self)
     79 logger.debug(
     80     "load_ssl_context verify=%r cert=%r trust_env=%r http2=%r",
     81     self.verify,
   (...)
     84     self.http2,
     85 )
     87 if self.verify:
---> 88     return self.load_ssl_context_verify()
     89 return self.load_ssl_context_no_verify()

File [/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:153](https://file+.vscode-resource.vscode-cdn.net/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:153), in SSLConfig.load_ssl_context_verify(self)
    150     logger.debug("load_verify_locations capath=%r", capath)
    151     context.load_verify_locations(capath=capath)
--> 153 self._load_client_certs(context)
    155 return context

File [/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:184](https://file+.vscode-resource.vscode-cdn.net/opt/homebrew/lib/python3.11/site-packages/httpx/_config.py:184), in SSLConfig._load_client_certs(self, ssl_context)
    182 if self.cert is not None:
    183     if isinstance(self.cert, str):
--> 184         ssl_context.load_cert_chain(certfile=self.cert)
    185     elif isinstance(self.cert, tuple) and len(self.cert) == 2:
    186         ssl_context.load_cert_chain(certfile=self.cert[0], keyfile=self.cert[1])

SSLError: [SSL] PEM lib (_ssl.c:3926)

You can find the certificate here: https://github.com/SideStore/apple-private-apis/blob/master/icloud-auth/src/apple_root.der

I tried to convert it to PEM format using:

openssl x509 -in apple_root.der -inform der -out apple_root.pem -outform pem

but it still gives the same error.

I am not sure it comes from the certificate since it is valid when used in the other program, at https://github.com/SideStore/apple-private-apis/blob/5aa6de4d3c631483f50b27a425f2bdbbd00c0cc4/icloud-auth/src/client.rs#L144-L149

Thanks for your help

[novitae]

Well it seems that requests also has this issue, so it doesn't come from here.