use certifi for tls connections, fixes #1348

proxy/raw_websocket.py

@@ -1,5 +1,6 @@
 import os
 import ssl
+import certifi
 import logging
 import base64
 import struct
@@ -21,8 +22,8 @@ _st_BBQ4s = struct.Struct('>BBQ4s')
 _st_H = struct.Struct('>H')
 _st_Q = struct.Struct('>Q')
 
-_ssl_ctx = ssl.create_default_context()
-_ssl_ctx_fronting = ssl.create_default_context()
+_ssl_ctx = ssl.create_default_context(cafile=certifi.where())
+_ssl_ctx_fronting = ssl.create_default_context(cafile=certifi.where())
 _ssl_ctx_fronting.check_hostname = False
 
 class WsHandshakeError(Exception):
@@ -290,4 +291,4 @@ class RawWebSocket:
             payload = await self.reader.readexactly(length)
             return opcode, _xor_mask(payload, mask_key), fin
         payload = await self.reader.readexactly(length)
-        return opcode, payload, fin
+        return opcode, payload, fin

ui/ctk_tray_ui.py

@@ -48,9 +48,10 @@ def _run_connectivity_test(cases: list, *, secure: bool = True) -> dict:
     import base64
     from contextlib import nullcontext
     import ssl
+    import certifi
     import socket as _socket
 
-    ctx = ssl.create_default_context() if secure else None
+    ctx = ssl.create_default_context(cafile=certifi.where()) if secure else None
     port = 443 if secure else 80
     results = {}
     for dc, connect_host, sni_host, req_host, path in cases: