Fix SSL certificate verification failure for hostnames with trailing dots (#1063)

R2
5mo ago
+18-10

Problem

When using httpx/httpcore with FQDNs that have trailing dots (e.g., myhost.mycompany.internal.), SSL certificate verification fails with:

httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Host name mismatch, certificate is not valid for 'myhost.mycompany.internal.'.

This is a known issue — Python's ssl module doesn't handle trailing dots in server_hostname. The Python SSL team has acknowledged this as an application-layer issue: https://bugs.python.org/issue31997

Solution

Strip the trailing dot from server_hostname before passing it to SSL backends. This follows the same approach used by urllib3.

The fix is applied at the connection level (where server_hostname is constructed) rather than in each backend, keeping the change minimal and centralized across 6 files:

  • httpcore/_async/connection.py
  • httpcore/_sync/connection.py
  • httpcore/_async/http_proxy.py
  • httpcore/_sync/http_proxy.py
  • httpcore/_async/socks_proxy.py
  • httpcore/_sync/socks_proxy.py

DNS resolution still uses the original hostname with the trailing dot — only the SSL SNI is normalized.

Fixes #1063