Upgrade from 2025.01.31 to 2025.4.26 broke certificate

[2-5]

this request worked in 2025.01.31 but fails in 2025.4.26:
https://api.hbdm.com/api/v1/contract_contract_info

urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='api.hbdm.com', port=443):
Max retries exceeded with url: /api/v1/contract_contract_info
(Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED]
certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

The request works in Firefox/Chrome.

[alex]

Does the request work in Firefox nightly?

[2-5]

I don't know, I don't use nightly.

[alex]

Ok, I hypothesize that it's broken there.

Looking at https://www.ssllabs.com/ssltest/analyze.html?d=api.hbdm.com&s=104.17.167.187&latest, I believe the problem is that "AAA Certificate Services" has been removed from the Mozilla trust store, and the server does not send the "SSL.com TLS Transit RSA CA R2" intermediate.

[2-5]

I don't know about these things. However this is a major bitcoin exchange. I have pinned my certifi to the previous version until this is solved by the website/certifi.

[alex]

Ok, well, since this appears to be working as intended, there's no action for us to take here.

[sfc-gh-dlisouski]

@alex Can you please also check the following: Cert with Fingerprint 1465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658 has been removed in 2025.4.26 but is still in the Mozilla trust store -- https://ccadb.my.salesforce-sites.com/mozilla/IncludedCACertificateReport

[alex]

Please see: https://bugzilla.mozilla.org/show_bug.cgi?id=1957701

[sfc-gh-dlisouski]

Thank you. Out of curiosity and for my own understanding: am I correct that 2025.4.26 includes changes for anticipated updates to the Mozilla trust store? In other words, the Mozilla trust store itself has not yet been updated, but certifi has already incorporated those changes? I'm curious how certifi and the Mozilla trust store are generally kept in sync. Thank you!

[alex]

We update when the NSS trust store migrates to the Firefox repo, which is to say roughly when changes go into nightly. This is before they're in a final Firefox release.

[phrfpeixoto]

I'm having similar issues with Shopify's GraphQL APIs
This is really NOT great

[alex]

Have you contacted Shopify?

[phrfpeixoto]

I am doing that right now.
EDIT
Though:

Also, downgrading to 2025.1.31 works.

[alex]

It appears that all the impacted websites are behind Cloudflare. I have reached out to folks there.

[ni-todo-spot]

I got here by following snowflake's status page: https://status.snowflake.com/incidents/txclg2cyzq32#:~:text=Customers%20hosted%20in%20AWS%20regions%20may,the%20certifi%20library%20to%20version%202025.4.26.

my project is using snowflake

Do you plan to fix this 🤔 ?

[BI-MarcB]

We are also affected by this issue. We use dbt (data build tool, a Python-based ETL tool) with Snowflake and S3 buckets. Our production pipeline broke because we are now unable to upload local files. This is the error we are encountering, which is related to the communication from Snowflake shared above.

Encountered an error while running operation: Runtime Error
254007: The certificate is revoked or could not be validated: hostname=sfc-eu-ds1-customer-stage.s3.amazonaws.com