[merfolk]

What?

Replace the CA bundle with certifi.

Why?

The certifilibrary is easier to keep up to date. For example, it's easy to add a Dependabot configuration for Python/pip requirements.

This will lead to more secure connections for consumers of the createsend-python package.

[merfolk]

Relates to #98

[AlexisT-CM]

@merfolk

One change before we merge this one: could you loosen the pin in requirements.txt to certifi>=2024.2.2? With ==, consumers can't pick up newer CA data without a new createsend release, and they'd hit resolver conflicts with other packages that depend on certifi. It'll also need a rebase now that #98 is merged. Once it's updated we'll release it as 9.2.0.

[merfolk]

@AlexisT-CM good point! I loosened the requirement as you suggested and rebased the branch. 🙂

Fair warning, though: only certifi>=2026.10.18 drops the compromised eMudhra / emSign G3 certificates:

• certifi/python-certifi@5cb238c
• https://emudhra.we-have-a-problem.com/

[AlexisT-CM]

@merfolk

Good catch on the emSign floor. I've pushed a commit to your branch raising the requirement to certifi>=2026.10.18, so existing installs on older certifi versions get upgraded instead of staying on a bundle with the compromised roots. I'll merge this and release it as 9.2.0.

Once again thanks for raising this 😃