HTTPie does not work on macOS unless certificate bundle is explicitly specified, even though requests does

httpie/client.py のリクエスト設定から始め、レポートに記載されている、失敗するデフォルトの HTTPS パスと、動作する明示的な --verify コマンドを比較してください。macOS で問題を再現し、トラストストアの選択方法を追跡して、明示的な証明書バンドルなしで https get google.com が成功することを示すリグレッションテストのカバレッジを追加してください。

Checklist

• I've searched for similar issues.
• I'm using the latest version of HTTPie.

Minimal reproduction code and steps

1. pip install httpie
2. https get google.com

Current result

https: error: SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)'))) while doing a GET request to URL: https://google.com/

…

Expected result

200 OK

Debug output

Please re-run the command with --debug, then copy the entire command & output and paste both below:

$ https --debug get google.com 2>&1 | pbcopy
HTTPie 3.2.4
Requests 2.32.3
Pygments 2.19.1
Python 3.13.3 (v3.13.3:6280bb54784, Apr  8 2025, 10:47:54) [Clang 15.0.0 (clang-1500.3.9.4)]
/Users/glyph/.local/pipx/venvs/httpie/bin/python
Darwin 24.5.0

<Environment {'apply_warnings_filter': <function Environment.apply_warnings_filter at 0x1031e1260>,
 'args': Namespace(),
 'as_silent': <function Environment.as_silent at 0x1031e1120>,
 'colors': 256,
 'config': {'default_options': []},
 'config_dir': PosixPath('/Users/glyph/.config/httpie'),
 'devnull': <property object at 0x10309a570>,
 'is_windows': False,
 'log_error': <function Environment.log_error at 0x1031e11c0>,
 'program_name': 'https',
 'quiet': 0,
 'rich_console': <functools.cached_property object at 0x10295a450>,
 'rich_error_console': <functools.cached_property object at 0x1030908d0>,
 'show_displays': True,
 'stderr': <_io.TextIOWrapper name='<stderr>' mode='w' encoding='utf-8'>,
 'stderr_isatty': False,
 'stdin': <_io.TextIOWrapper name='<stdin>' mode='r' encoding='utf-8'>,
 'stdin_encoding': 'utf-8',
 'stdin_isatty': True,
 'stdout': <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>,
 'stdout_encoding': 'utf-8',
 'stdout_isatty': False}>

<PluginManager {'adapters': [],
 'auth': [<class 'httpie.plugins.builtin.BasicAuthPlugin'>,
          <class 'httpie.plugins.builtin.DigestAuthPlugin'>,
          <class 'httpie.plugins.builtin.BearerAuthPlugin'>],
 'converters': [],
 'formatters': [<class 'httpie.output.formatters.headers.HeadersFormatter'>,
                <class 'httpie.output.formatters.json.JSONFormatter'>,
                <class 'httpie.output.formatters.xml.XMLFormatter'>,
                <class 'httpie.output.formatters.colors.ColorFormatter'>]}>

>>> requests.request(**{'auth': None,
 'data': RequestJSONDataDict(),
 'headers': <HTTPHeadersDict('User-Agent': b'HTTPie/3.2.4')>,
 'method': 'get',
 'params': <generator object MultiValueOrderedDict.items at 0x10413c6d0>,
 'url': 'https://google.com'})


https: error: SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)'))) while doing a GET request to URL: https://google.com/


Traceback (most recent call last):
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/connectionpool.py", line 464, in _make_request
    self._validate_conn(conn)
    ~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/connectionpool.py", line 1093, in _validate_conn
    conn.connect()
    ~~~~~~~~~~~~^^
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/connection.py", line 741, in connect
    sock_and_verified = _ssl_wrap_socket_and_match_hostname(
        sock=sock,
    ...<14 lines>...
        assert_fingerprint=self.assert_fingerprint,
    )
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/connection.py", line 920, in _ssl_wrap_socket_and_match_hostname
    ssl_sock = ssl_wrap_socket(
        sock=sock,
    ...<8 lines>...
        tls_in_tls=tls_in_tls,
    )
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/util/ssl_.py", line 480, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/util/ssl_.py", line 524, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
           ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/ssl.py", line 455, in wrap_socket
    return self.sslsocket_class._create(
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        sock=sock,
        ^^^^^^^^^^
    ...<5 lines>...
        session=session
        ^^^^^^^^^^^^^^^
    )
    ^
  File "/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/ssl.py", line 1076, in _create
    self.do_handshake()
    ~~~~~~~~~~~~~~~~~^^
  File "/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/ssl.py", line 1372, in do_handshake
    self._sslobj.do_handshake()
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/connectionpool.py", line 787, in urlopen
    response = self._make_request(
        conn,
    ...<10 lines>...
        **response_kw,
    )
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/connectionpool.py", line 488, in _make_request
    raise new_e
urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/requests/adapters.py", line 667, in send
    resp = conn.urlopen(
        method=request.method,
    ...<9 lines>...
        chunked=chunked,
    )
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/connectionpool.py", line 841, in urlopen
    retries = retries.increment(
        method, url, error=new_e, _pool=self, _stacktrace=sys.exc_info()[2]
    )
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/urllib3/util/retry.py", line 519, in increment
    raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/glyph/.local/bin/https", line 8, in <module>
    sys.exit(main())
             ~~~~^^
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/httpie/__main__.py", line 9, in main
    exit_status = main()
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/httpie/core.py", line 162, in main
    return raw_main(
        parser=parser,
    ...<2 lines>...
        env=env
    )
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/httpie/core.py", line 136, in raw_main
    handle_generic_error(propagated_exc, annotation=annotation)
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/httpie/core.py", line 100, in raw_main
    exit_status = main_program(
        args=parsed_args,
        env=env,
    )
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/httpie/core.py", line 213, in program
    for message in messages:
                   ^^^^^^^^
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/httpie/client.py", line 114, in collect_messages
    response = requests_session.send(
        request=prepared_request,
        **send_kwargs_merged,
        **send_kwargs,
    )
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/requests/sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
  File "/Users/glyph/.local/pipx/venvs/httpie/lib/python3.13/site-packages/requests/adapters.py", line 698, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)')))

Additional information, screenshots, or code examples

certifi is installed. requests can load google.com just fine from this venv. https --verify "$(~/.local/pipx/venvs/httpie/bin/python -m certifi)" get google.com works. This just seems to be a problem with httpie not finding a trust store by default.