From de1aa408e1c04726869b9172d59bb8642b66c1cf Mon Sep 17 00:00:00 2001
From: varonix <62331820+varonix0@users.noreply.github.com>
Date: Wed, 21 Oct 2026 22:54:16 +0400
Subject: [PATCH 1/2] fix: require certifi>=2026.10.19 to drop compromised
 eMudhra roots

---
 requirements.txt | 1 +
 setup.py         | 1 +
 2 files changed, 2 insertions(+)

diff --git a/requirements.txt b/requirements.txt
index ca31b1a..bba9d44 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,3 +4,4 @@ aenum >= 3.1.11
 requests >= 2.31.0
 boto3 >= 1.33.8
 botocore >= 1.33.8
+certifi >= 2026.10.19
diff --git a/setup.py b/setup.py
index dd722f1..798939a 100644
--- a/setup.py
+++ b/setup.py
@@ -23,6 +23,7 @@
     "requests~=2.32",
     "boto3~=1.35",
     "botocore~=1.35",
+    "certifi>=2026.10.19",
 ]
 
 setup(

From 4e4b3c198e3d0bd591ad55ab9706feb824b537fb Mon Sep 17 00:00:00 2001
From: varonix <62331820+varonix0@users.noreply.github.com>
Date: Wed, 21 Oct 2026 23:31:37 +0400
Subject: [PATCH 2/2] docs: document REQUESTS_CA_BUNDLE for self-hosted
 instances with a private CA

---
 README.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/README.md b/README.md
index 7daa3db..fdefbd4 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,22 @@ If you’re working with Python, the official Infisical Python SDK package is th
 ## Documentation
 You can find the documentation for the Python SDK on our [SDK documentation page](https://infisical.com/docs/sdks/languages/python).
 
+## Self-hosted instances with a private CA
+
+The SDK uses `requests`, which verifies TLS certificates against the Mozilla CA bundle from the `certifi` package. It does not read your operating system trust store.
+
+If your self-hosted Infisical instance uses a certificate from a private or corporate CA, set `REQUESTS_CA_BUNDLE` to a CA bundle file that contains that CA:
+
+```bash
+# Debian / Ubuntu
+export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
+
+# Fedora / RHEL
+export REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt
+```
+
+These paths are the operating system bundles, so the CA must be added there first (for example with `update-ca-certificates` or `update-ca-trust`). You can also point `REQUESTS_CA_BUNDLE` to a PEM file that holds only your CA.
+
 ## Security
 
 Please do not file GitHub issues or post on our public forum for security vulnerabilities, as they are public!