Chapter 8 · Proxies and SSL/TLS

Chapter goals: master proxied network access, SSL certificate verification, and client certificate configuration so requests stay secure and controllable.

8.1 Why You Need Proxies

Proxies are extremely common in corporate networks: firewalls may require all outbound traffic to pass through a proxy, blocked resources may only be reachable through one, or you may need centralized traffic monitoring.

import requests

# Set HTTP proxies
proxies = {
    'http': 'http://10.10.1.10:3128',
    'https': 'http://10.10.1.10:3128',
}

resp = requests.get('https://example.com', proxies=proxies)

httpx uses the same dict format:

import httpx

proxies = {
    'all://': 'http://proxy.example.com:8080',  # matches all protocols
}

with httpx.Client(proxies=proxies) as client:
    resp = client.get('https://example.com')

8.2 Proxy Authentication

Proxies that require credentials:

# requests: embed credentials in the URL
proxies = {
    'http': 'http://user:pass@proxy.example.com:8080',
    'https': 'http://user:pass@proxy.example.com:8080',
}

# httpx: via the Proxy object with auth
proxy = httpx.Proxy(
    url='http://user:pass@proxy.example.com:8080',
    auth=('user', 'pass')
)

8.3 SSL Certificate Verification

By default both requests and httpx verify the server's SSL certificate. This is the single most important security feature — skipping it exposes you to man-in-the-middle attacks.

import requests

# Default behavior: verify certificates
resp = requests.get('https://example.com')

# Disable verification (not recommended for production)
resp = requests.get('https://self-signed.badssl.com', verify=False)
# ⚠️ Triggers InsecureRequestWarning

httpx verifies by default, with stricter warnings:

import httpx

# Default verification
with httpx.Client() as client:
    resp = client.get('https://example.com')

# Disable verification (also not recommended)
with httpx.Client(verify=False) as client:
    resp = client.get('https://self-signed.badssl.com')

8.4 Custom CA Certificates

Enterprises often use their own CA; point to a CA bundle:

import requests

# Specify a CA bundle path
resp = requests.get(
    'https://internal.example.com',
    verify='/path/to/ca-bundle.crt'
)

# A directory works too
resp = requests.get(
    'https://internal.example.com',
    verify='/etc/ssl/certs/'
)

httpx supports this as well:

import httpx

with httpx.Client(verify='/path/to/ca-bundle.crt') as client:
    resp = client.get('https://internal.example.com')

8.5 Client Certificates

Mutual TLS (mTLS) requires a client certificate:

import requests

# Option 1: PEM-format certificate
resp = requests.get(
    'https://example.com',
    cert=('/path/to/client.crt', '/path/to/client.key')
)

# Option 2: build an ssl context (works for p12 chains too)
import ssl
ssl_context = ssl.create_default_context()
ssl_context.load_cert_chain('/path/to/client.crt', '/path/to/client.key')

import httpx
transport = httpx.HTTPTransport(ssl=ssl_context)
with httpx.Client(transport=transport) as client:
    resp = client.get('https://example.com')

8.6 Combining Proxies and SSL in Practice

import requests
from requests.auth import HTTPProxyAuth

proxies = {
    'http': 'http://proxy.example.com:8080',
    'https': 'http://proxy.example.com:8080',
}
auth = HTTPProxyAuth('proxyuser', 'proxypass')

resp = requests.get(
    'https://internal.example.com',
    proxies=proxies,
    auth=auth,
    verify='/etc/ssl/internal-ca.pem'
)

8.7 Chapter Summary

• Configure proxies via a proxies dict supporting http/https/all schemes;
• Never disable SSL verification (verify=False) in production;
• Custom CA bundles solve internal-certificate issues;
• Client certs go through cert (requests) or an SSLContext (httpx).

🧪 随堂测验

点击你认为正确的选项。答错时会展示正确答案与原因解析。

1. What is the correct way to disable SSL verification in requests?

2. How do you configure proxies in httpx?

3. Which is the safest way to handle self-signed certificates?

4. What does the cert argument in requests accept?

🛠️ Hands-On Exercises

1. Configure a proxy to reach https://httpbin.org/ip and print your egress IP.
2. Try https://self-signed.badssl.com with verify=True vs verify=False and compare.
3. Load a custom CA certificate and call an internal service secured by it.

After finishing the exercises, move on to the next chapter.