Set SSL_CERT_FILE with NetworkOptions if unset

CHANGELOG.md

@@ -1,6 +1,11 @@
 # Changelog
 
 ## Unreleased
+* Set `SSL_CERT_FILE` from `NetworkOptions.ca_roots_path()` before starting the
+  interpreter, unless it is already set. Python's `ssl` can otherwise bind to Julia's
+  `libssl`, whose compiled-in certificate paths do not exist outside the build
+  container, so every HTTPS request from Python fails with
+  `CERTIFICATE_VERIFY_FAILED` ([#651](https://github.com/JuliaPy/PythonCall.jl/issues/651)).
 * Bug fixes.
 
 ## 0.9.36 (2026-09-18)

Project.toml

@@ -9,6 +9,7 @@ Dates = "ade2ca70-3891-5945-98fb-dc099432e06a"
 Libdl = "8f399da3-3557-5675-b5ff-fb832c97cbdb"
 MacroTools = "1914dd2f-81c6-5fcd-8719-6d5c9610ff09"
 Markdown = "d6f4376e-aef5-505a-96c1-9c027394607a"
+NetworkOptions = "ca575930-c2e3-43a9-ace4-1e988b2c1908"
 Preferences = "21216c6a-2e73-6563-6e65-726566657250"
 Serialization = "9e88b42a-f829-5b0c-bbe9-9e923198166b"
 Tables = "bd369af6-aec1-5ad0-b16a-f7cc5008161c"
@@ -21,6 +22,7 @@ Dates = "1"
 Libdl = "1"
 MacroTools = "0.5"
 Markdown = "1"
+NetworkOptions = "1"
 Preferences = "1"
 PyCall = "1"
 Serialization = "1"

src/C/C.jl

@@ -12,6 +12,7 @@ using UnsafePointers: UnsafePtr
 using Libdl:
     dlpath, dlopen, dlopen_e, dlclose, dlsym, dlsym_e, RTLD_LAZY, RTLD_DEEPBIND, RTLD_GLOBAL
 using Preferences: @load_preference
+using NetworkOptions: NetworkOptions
 
 # do not load CondaPkg if the exe preference is set to something else
 if @load_preference("exe", "@CondaPkg") == "@CondaPkg"

src/C/context.jl

@@ -288,6 +288,10 @@ function init_context()
                 )
             end
 
+            # Ensure Python has a usable set of CA certificates.
+            # See https://github.com/JuliaPy/PythonCall.jl/issues/651
+            get!(ENV, "SSL_CERT_FILE", NetworkOptions.ca_roots_path())
+
             # Start the interpreter and register exit hooks
             Py_InitializeEx(0)
             atexit() do