Slow certificate verification in Windows

[shaperilio]

I was playing with FastAPI and used httpx to make simple requests. I was surprised by how slow it was (a request to a server running on a separate process on the same machine took 1/4 second). Most of the delay was between the client making the request and the server receiving it.

I was making the requests like this:

httpx.get(f'{self._url}/{path}', params=url_params)

Upon examining the logs, I saw a big delay in load_verify_locations:

[2024-12-03 16:35:03.819|     httpcore.http11] receive_response_body.started request=<Request [b'GET']>
[2024-12-03 16:35:03.819|     httpcore.http11] receive_response_body.complete
[2024-12-03 16:35:03.820|     httpcore.http11] response_closed.started
[2024-12-03 16:35:03.820|     httpcore.http11] response_closed.complete
[2024-12-03 16:35:03.820| httpcore.connection] close.started
[2024-12-03 16:35:03.820| httpcore.connection] close.complete
[2024-12-03 16:35:03.820|               httpx] load_ssl_context verify=True cert=None trust_env=True http2=False
[2024-12-03 16:35:03.821|               httpx] load_verify_locations cafile='C:\\xxx\\venv12\\Lib\\site-packages\\certifi\\cacert.pem'
[2024-12-03 16:35:04.059| httpcore.connection] connect_tcp.started host='winbox' port=42069 local_address=None timeout=5.0 socket_options=None
[2024-12-03 16:35:04.060| httpcore.connection] connect_tcp.complete return_value=<httpcore._backends.sync.SyncStream object at 0x000001E2070E4F80>

Running the same code on a Linux machine gave me this:

[2024-12-03 16:40:11.572|     httpcore.http11] receive_response_body.started request=<Request [b'GET']>
[2024-12-03 16:40:11.573|     httpcore.http11] receive_response_body.complete
[2024-12-03 16:40:11.573|     httpcore.http11] response_closed.started
[2024-12-03 16:40:11.573|     httpcore.http11] response_closed.complete
[2024-12-03 16:40:11.573| httpcore.connection] close.started
[2024-12-03 16:40:11.573| httpcore.connection] close.complete
[2024-12-03 16:40:11.588| httpcore.connection] connect_tcp.started host='linbox' port=42069 local_address=None timeout=5.0 socket_options=None
[2024-12-03 16:40:11.588| httpcore.connection] connect_tcp.complete return_value=<httpcore._backends.sync.SyncStream object at 0x7f54a6483320>

Note the lack of SSL anything.

I was able to get it to go fast in Windows by adding verify=False to my get call:

httpx.get(f'{self._url}/{path}', params=url_params, verify=False)

gives

[2024-12-03 16:31:45.539|     httpcore.http11] receive_response_body.started request=<Request [b'GET']>
[2024-12-03 16:31:45.539|     httpcore.http11] receive_response_body.complete
[2024-12-03 16:31:45.540|     httpcore.http11] response_closed.started
[2024-12-03 16:31:45.540|     httpcore.http11] response_closed.complete
[2024-12-03 16:31:45.540| httpcore.connection] close.started
[2024-12-03 16:31:45.540| httpcore.connection] close.complete
[2024-12-03 16:31:45.540|               httpx] load_ssl_context verify=False cert=None trust_env=True http2=False
[2024-12-03 16:31:45.541| httpcore.connection] connect_tcp.started host='winbox' port=42069 local_address=None timeout=5.0 socket_options=None
[2024-12-03 16:31:45.542| httpcore.connection] connect_tcp.complete return_value=<httpcore._backends.sync.SyncStream object at 0x0000019B67B16330>

Both machines are running freshly installed environments; Python 3.12 with httpx 0.28.0. So:

1. Why is the behavior different between Linux and Windows? I.e. why are certificates being loaded in Windows and not in Linux with default arguments in httpx.get?
2. Why is any SSL stuff being done for http:// requests? If I set verify=True in Linux, those lines still don't appear in the log, and requests are still fast.
3. Is it expected that loading the certificates would take that long?

EDIT
The windows logs above are not what comes out of httpx 0.28.0 - in an effort to dot my eyes while writing this post, I updated the whole virtual environment and didn't realize I wasn't running the lastest (I first installed httpx a couple of weeks ago, and now I don't know what version that was). The logs with 0.28.0 actually show this:

[2024-12-03 16:51:31.303|     httpcore.http11] receive_response_body.started request=<Request [b'GET']>
[2024-12-03 16:51:31.303|     httpcore.http11] receive_response_body.complete
[2024-12-03 16:51:31.303|     httpcore.http11] response_closed.started
[2024-12-03 16:51:31.303|     httpcore.http11] response_closed.complete
[2024-12-03 16:51:31.304| httpcore.connection] close.started
[2024-12-03 16:51:31.304| httpcore.connection] close.complete
[2024-12-03 16:51:31.548| httpcore.connection] connect_tcp.started host='winbox' port=42069 local_address=None timeout=5.0 socket_options=None
[2024-12-03 16:51:31.567| httpcore.connection] connect_tcp.complete return_value=<httpcore._backends.sync.SyncStream object at 0x0000025559EDD700>

Note the big delay (which still goes away with verify=False) is now "hidden" between close.complete and connect_tcp.started

[tomchristie]

I'd suggest instantiating a client instance so that you're not reloading the SSL context repeatedly.
That's probably the issue you're seeing.

You could also look into different SSL configs (although ideally you shouldn't have to)...

• verify=ssl.create_default_context(certifi.where()) Our current default.
• verify=ssl.create_default_context() You might not actually need certifi on windows, you could see if this is any faster.
• verify=truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT) We're considering switching to truststore as our default.

[shaperilio]

Why is any SSL stuff happening in the functional form of a GET request if the target URL does not require encryption?

[shaperilio]

I changed my code to create a client as you suggested. It's significantly faster than the functional form with verify=False. In Linux, it seems to run 2-3x faster.

In the introduction and quick start sections of the documentation, everything is using the functional form. I suppose that makes sense for the introduction so people can copy and paste stuff and do a quick test. But based on this experience, it doesn't seem like the functional form should be used in practice. Am I missing something?

[tomchristie]

Why is any SSL stuff happening in the functional form of a GET request if the target URL does not require encryption?

We unconditionally create the SSL context once, when instating a client.
The top level shortcuts do that for every call.

But based on this experience, it doesn't seem like the functional form should be used in practice.

Agree. (…)