René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"SDK does not respect SSL_CERT_FILE or REQUESTS_CA_BUNDLE environment variables","articleBody":"## Problem\n\nThe Polygon Python SDK fails with SSL certificate verification errors when used behind corporate firewalls that perform SSL/TLS inspection. The SDK does not respect standard SSL certificate environment variables (`SSL_CERT_FILE`, `REQUESTS_CA_BUNDLE`) that specify custom CA bundles.\n\n## Steps to Reproduce\n\n```python\nimport os\nfrom polygon import RESTClient\n\n# Set custom CA bundle (common in enterprise environments)\nos.environ[\"SSL_CERT_FILE\"] = \"/path/to/corporate-ca-bundle.pem\"\n\n# This fails with SSL error\nclient = RESTClient(os.getenv(\"POLYGON_API_KEY\"))\naggs = client.get_aggs(ticker=\"AAPL\", multiplier=1, timespan=\"day\",\n                       from_=\"2026-02-01\", to=\"2026-02-10\")\nlist(aggs)  # SSLError: certificate verify failed\n```\n\n## Expected Behaviour\n\nSDK should respect SSL environment variables like other Python HTTP libraries (requests, httpx, urllib3).\n\n## Actual Behaviour\n\n```\nSSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:\nself-signed certificate in certificate chain\n```\n\nSDK ignores environment variables and uses bundled certifi CA bundle only.\n\n## Evidence\n\n**Raw Python SSL (works):**\n```python\nimport ssl, socket\ncontext = ssl.create_default_context()\nwith socket.create_connection((\"api.polygon.io\", 443)) as sock:\n    with context.wrap_socket(sock, server_hostname=\"api.polygon.io\") as s:\n        print(s.version())  # ✅ TLSv1.3 - Success!\n```\n\n**Polygon SDK (fails):**\nUses bundled certs, ignores `SSL_CERT_FILE` → certificate verification fails.\n\n## Root Cause\n\nThe SDK uses `urllib3` but doesn't configure it to check standard SSL environment variables. While `urllib3` supports custom CA bundles, the Polygon SDK never provides them.\n\n## Comparison: Alpaca SDK (Works Correctly)\n\n```python\n# Alpaca SDK respects SSL_CERT_FILE and works behind corporate firewalls\nfrom alpaca.data.historical import StockHistoricalDataClient\nclient = StockHistoricalDataClient(api_key, secret_key)\nbars = client.get_stock_bars(...)  # ✅ Works!\n```\n\n## Suggested Fix\n\nCheck environment variables when creating HTTP client:\n\n```python\nimport os\nimport certifi\n\ndef get_ca_bundle():\n    \"\"\"Get CA bundle from environment or default.\"\"\"\n    return (os.getenv(\"SSL_CERT_FILE\") or\n            os.getenv(\"REQUESTS_CA_BUNDLE\") or\n            certifi.where())\n\n# Use in RESTClient\nhttp = urllib3.PoolManager(cert_reqs=\"CERT_REQUIRED\",\n                           ca_certs=get_ca_bundle())\n```\n\n## Impact\n\n**Affects:** Enterprise users behind corporate firewalls with SSL inspection (finance, healthcare, government sectors)\n\n**Current workarounds:** All unacceptable for production:\n- ❌ Disable SSL verification (insecure)\n- ❌ Switch to different provider\n- ❌ Maintain local SDK patches\n\n## Environment\n\n- **Python:** 3.10+\n- **OS:** macOS/Linux\n- **Network:** Corporate firewall with SSL inspection (Zscaler, etc.)\n- **polygon-api-client:** Latest\n\n## References\n\n- urllib3 docs: https://urllib3.readthedocs.io/en/stable/advanced-usage.html#custom-ssl-certificates\n- Example implementation: [alpaca-py SDK](https://github.com/alpacahq/alpaca-py)\n- Standard practice: requests, httpx, aiohttp all respect these env vars\n\nHappy to submit a PR if maintainers are open to this fix.\nThis issue generated with AI/Claude 4.6\n","author":{"url":"https://github.com/farmerbean","@type":"Person","name":"farmerbean"},"datePublished":"2026-02-12T16:50:11.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/998/client-python/issues/998"}