how do I update root certificates of certifi?

Question

I am using certifi python module to verify ssl connections. I looked at the root certificates included in certifi (python2.7/site-packages/certifi/cacert.pem) and some of those certificates have expired. How do I update those certificates? I tried updating certifi package using pip but that only updates the package and not the root CA files.

Solution

certifi/cacert.pem is, naturally, a part of certifi. Consequently, it's supposed to be updated with the module.

• You can check if the latest code at https://github.com/certifi/python-certifi has a newer bundle and if it does, install the module directly from there with pip install git+https://github.com/certifi/python-certifi.
• You can also replace cacert.pem with any other certificate bundle that meets your needs, like the Mozilla root certificate store. Of course, your changes will be lost the next time you update the module.