Fix SSL certificate verification failure for hostnames with trailing dots (#1063)
R2
5mo ago+18+18+01234567890123456789-10-10-01234567890123456789
Problem
When using httpx/httpcore with FQDNs that have trailing dots (e.g., myhost.mycompany.internal.), SSL certificate verification fails with:
httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Host name mismatch, certificate is not valid for 'myhost.mycompany.internal.'.
This is a known issue — Python's ssl module doesn't handle trailing dots in server_hostname. The Python SSL team has acknowledged this as an application-layer issue: https://bugs.python.org/issue31997
Solution
Strip the trailing dot from server_hostname before passing it to SSL backends. This follows the same approach used by urllib3.
The fix is applied at the connection level (where server_hostname is constructed) rather than in each backend, keeping the change minimal and centralized across 6 files:
httpcore/_async/connection.pyhttpcore/_sync/connection.pyhttpcore/_async/http_proxy.pyhttpcore/_sync/http_proxy.pyhttpcore/_async/socks_proxy.pyhttpcore/_sync/socks_proxy.py
DNS resolution still uses the original hostname with the trailing dot — only the SSL SNI is normalized.
Fixes #1063