# Pysonar should depend on truststore

**URL:** <https://community.sonarsource.com/t/pysonar-should-depend-on-truststore/184965>\
**Category:** SonarQube Server / Community Build\
**Tags:** scanner\
**Created:** [July 6, 2026, 7:26pm UTC](https://community.sonarsource.com/t/pysonar-should-depend-on-truststore/184965 "2026-07-06T19:26:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leodevian](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/leodevian/32/76828_2.png) [@leodevian](https://community.sonarsource.com/u/leodevian)\
**Post date:** [July 6, 2026, 7:26pm UTC](https://community.sonarsource.com/t/pysonar-should-depend-on-truststore/184965/1 "2026-07-06T19:26:30Z")

</div>

Hello,

I’m really interested in using pysonar, but it depends on requests, which itself relies on certifi as a root certificate store.

This causes issues in corporate environments (such as mine) where self-signed system certificates must be used to secure connections to self-hosted services such as SonarQube Server.

truststore seems like a good candidate as it is already widely used within the Python community:

- [pip vendors truststore since 2022](https://github.com/pypa/pip/tree/main/src/pip/_vendor/truststore): it has been the default behavior since 2024 (pip v24.2),

- popular HTTP clients depend on truststore: httpx2, niquests.

It is maintained by [Seth Larson](https://github.com/sethmlarson), Python core developer and Security Developer at the Python Software Foundation.

truststore depends on Python 3.10 and so does pysonar.

Instead of using `requests.get`, pysonar would have to use a `requests.Session` instance, create an HTTP adapter using SSL context from truststore, and mount it using `requests.Session.mount` (see [pip/src/pip/\_internal/network/session.py](https://github.com/pypa/pip/blob/main/src/pip/_internal/network/session.py) for reference).

I would really enjoy using pysonar and I hope that you will be interested in this suggestion!

---

<div class="post-metadata">

**Author:** ![stevan.vanderwerf](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/stevan.vanderwerf/32/76888_2.png) [@stevan.vanderwerf](https://community.sonarsource.com/u/stevan.vanderwerf)\
**Post date:** [July 10, 2026, 3:11am UTC](https://community.sonarsource.com/t/pysonar-should-depend-on-truststore/184965/2 "2026-07-10T03:11:41Z")

</div>

Hi @leodevian,

Thanks for the detailed write-up, helpful feedback for our teams.

The underlying pain point you’ve identified is already tracked internally. The two-store problem (Python `requests`/certifi for the bootstrapping layer + Java truststore for the analysis engine itself) is a known friction point for corporate environments. I don’t have a timeline for its implementation, but here’s the public ticket: [Jira](https://sonarsource.atlassian.net/browse/SCANPY-124).

For now, the workaround is to set the `REQUESTS_CA_BUNDLE` or `SSL_CERT_FILE` environment variable to a certificate bundle that includes your corporate CA:

```auto
export REQUESTS_CA_BUNDLE=/path/to/your/ca-bundle.crt
pysonar-scanner ...

```

This covers the Python `requests` side. For the Java analysis engine side, you’ll also need to provide a PKCS#12 truststore, see [TLS certificates on client side](https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/scanner-environment/manage-tls-certificates) for details.

I’ll flag your `truststore` suggestion to the team as a concrete implementation path worth considering, the pip reference implementation you linked is a good precedent.

Cheers,

Stevan

---

<div class="post-metadata">

**Author:** ![leodevian](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/leodevian/32/76828_2.png) [@leodevian](https://community.sonarsource.com/u/leodevian)\
**Post date:** [September 1, 2026, 1:23pm UTC](https://community.sonarsource.com/t/pysonar-should-depend-on-truststore/184965/4 "2026-09-01T13:23:42Z")

</div>

Hello Stevan,

Thank you for your answer. While `REQUESTS_CA_BUNDLE` and `SSL_CERT_FILE` work nicely on Linux (where system certs are stored at known locations), it can be tricker to set these variables on Windows (where system certs are stored in the system store).

Personnaly I did install truststore alongside pysonar and added `_truststore.pth` in the site-packages directory:

```auto
import truststore; truststore.inject_into_ssl()

```

It works but it is a hack that relies on the site module…

Cheers,

Léo