Skip to content

Chargebee Python Client should not bundle its own certificates #114

Open

Description

@vanschelven

Description of the Bug

As per

ca_cert_path = os.path.join(os.path.dirname(__file__), "ssl", "ca-certs.crt")
the Chargebee Python Client bundles its own certificates.

In my not-so-humble opinion this violates the expectation of least surprise: on correctly configured systems the certificate bundles are present and reachable by python code. By pushing this stuff into a specific package you tie the ability of the system to make connections to the outside world to a specific version of chargebee and you tie the upgrade-cycle of your codebase (e.g. with pinned packages) to certificate validity.

There is a reason all the other request-making packages in the python ecosystem don't do this.

Now, I understand why this choice was made (it allows you to package something that "just works") but given that it's the WrongChoice(TM) you should at least create a point of configuration such that one can point the chargebee client either to the system certificate bundles, or just tell it to do whatever the underlying library (e.g. requests) would normally do.

Additional context

#60 is a direct consequence of this problem (and the suggested solution of "just upgrade") proves this

Activity

  1. vanschelven commented on Feb 10, 2026

    @vanschelven
    Author

    It also means that:

    • if the chargebee bundle contains a root cert that is later to be found to be untrustworthy chargebee now has a security problem and requires an update
    • if you're in a corporate environment where they want to MITM your certs as per corporate policy you're out of luck because you can't configure your corporate MITM thingie properly
  2. cb-alish commented on Feb 18, 2026

    @cb-alish
    Collaborator

    Hi @vanschelven,

    You’re absolutely right. We’re currently evaluating the impact of removing this from the SDK and analyzing any potential consequences.

    We’re planning to remove it in the near future, and we’ll keep you posted with updates here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions