SDK does not respect SSL_CERT_FILE or REQUESTS_CA_BUNDLE environment variables

从 RESTClient 的构造以及 get_aggs 使用的 urllib3 HTTP 客户端路径开始；检查其 CA bundle 是如何选择的。设置 SSL_CERT_FILE 或 REQUESTS_CA_BUNDLE 后复现该请求，然后验证 get_aggs 能够通过自定义证书链成功执行，同时不禁用验证。

Problem

The Polygon Python SDK fails with SSL certificate verification errors when used behind corporate firewalls that perform SSL/TLS inspection. The SDK does not respect standard SSL certificate environment variables (SSL_CERT_FILE, REQUESTS_CA_BUNDLE) that specify custom CA bundles.

Steps to Reproduce

import os
from polygon import RESTClient

# Set custom CA bundle (common in enterprise environments)
os.environ["SSL_CERT_FILE"] = "/path/to/corporate-ca-bundle.pem"

# This fails with SSL error
client = RESTClient(os.getenv("POLYGON_API_KEY"))
aggs = client.get_aggs(ticker="AAPL", multiplier=1, timespan="day",
                       from_="2026-02-01", to="2026-02-10")
list(aggs)  # SSLError: certificate verify failed

Expected Behaviour

SDK should respect SSL environment variables like other Python HTTP libraries (requests, httpx, urllib3).

Actual Behaviour

SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
self-signed certificate in certificate chain

SDK ignores environment variables and uses bundled certifi CA bundle only.

Evidence

Raw Python SSL (works):

import ssl, socket
context = ssl.create_default_context()
with socket.create_connection(("api.polygon.io", 443)) as sock:
    with context.wrap_socket(sock, server_hostname="api.polygon.io") as s:
        print(s.version())  # ✅ TLSv1.3 - Success!

Polygon SDK (fails):
Uses bundled certs, ignores SSL_CERT_FILE → certificate verification fails.

Root Cause

The SDK uses urllib3 but doesn't configure it to check standard SSL environment variables. While urllib3 supports custom CA bundles, the Polygon SDK never provides them.

Comparison: Alpaca SDK (Works Correctly)

# Alpaca SDK respects SSL_CERT_FILE and works behind corporate firewalls
from alpaca.data.historical import StockHistoricalDataClient
client = StockHistoricalDataClient(api_key, secret_key)
bars = client.get_stock_bars(...)  # ✅ Works!

Suggested Fix

Check environment variables when creating HTTP client:

import os
import certifi

def get_ca_bundle():
    """Get CA bundle from environment or default."""
    return (os.getenv("SSL_CERT_FILE") or
            os.getenv("REQUESTS_CA_BUNDLE") or
            certifi.where())

# Use in RESTClient
http = urllib3.PoolManager(cert_reqs="CERT_REQUIRED",
                           ca_certs=get_ca_bundle())

Impact

Affects: Enterprise users behind corporate firewalls with SSL inspection (finance, healthcare, government sectors)

Current workarounds: All unacceptable for production:

• ❌ Disable SSL verification (insecure)
• ❌ Switch to different provider
• ❌ Maintain local SDK patches

Environment

• Python: 3.10+
• OS: macOS/Linux
• Network: Corporate firewall with SSL inspection (Zscaler, etc.)
• polygon-api-client: Latest

References

• urllib3 docs: https://urllib3.readthedocs.io/en/stable/advanced-usage.html#custom-ssl-certificates
• Example implementation: alpaca-py SDK
• Standard practice: requests, httpx, aiohttp all respect these env vars

Happy to submit a PR if maintainers are open to this fix.
This issue generated with AI/Claude 4.6