From e519c4df4c38490ab7beb93a9531c1d35eaff31d Mon Sep 17 00:00:00 2001
From: Flowseal <sellyalegium@gmail.com>
Date: Sat, 19 Sep 2026 22:48:25 +0300
Subject: [PATCH] use certifi for tls connections, fixes #1348

---
 proxy/raw_websocket.py | 7 ++++---
 ui/ctk_tray_ui.py      | 3 ++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/proxy/raw_websocket.py b/proxy/raw_websocket.py
index dab4778..a718ea1 100644
--- a/proxy/raw_websocket.py
+++ b/proxy/raw_websocket.py
@@ -1,5 +1,6 @@
 import os
 import ssl
+import certifi
 import logging
 import base64
 import struct
@@ -21,8 +22,8 @@ _st_BBQ4s = struct.Struct('>BBQ4s')
 _st_H = struct.Struct('>H')
 _st_Q = struct.Struct('>Q')
 
-_ssl_ctx = ssl.create_default_context()
-_ssl_ctx_fronting = ssl.create_default_context()
+_ssl_ctx = ssl.create_default_context(cafile=certifi.where())
+_ssl_ctx_fronting = ssl.create_default_context(cafile=certifi.where())
 _ssl_ctx_fronting.check_hostname = False
 
 class WsHandshakeError(Exception):
@@ -290,4 +291,4 @@ class RawWebSocket:
             payload = await self.reader.readexactly(length)
             return opcode, _xor_mask(payload, mask_key), fin
         payload = await self.reader.readexactly(length)
-        return opcode, payload, fin
\ No newline at end of file
+        return opcode, payload, fin
diff --git a/ui/ctk_tray_ui.py b/ui/ctk_tray_ui.py
index 62a8731..7487e49 100644
--- a/ui/ctk_tray_ui.py
+++ b/ui/ctk_tray_ui.py
@@ -48,9 +48,10 @@ def _run_connectivity_test(cases: list, *, secure: bool = True) -> dict:
     import base64
     from contextlib import nullcontext
     import ssl
+    import certifi
     import socket as _socket
 
-    ctx = ssl.create_default_context() if secure else None
+    ctx = ssl.create_default_context(cafile=certifi.where()) if secure else None
     port = 443 if secure else 80
     results = {}
     for dc, connect_host, sni_host, req_host, path in cases: