1 diff --git a/certifi/core.py b/certifi/core.py
2 index 91f538b..1110ce0 100644
5 @@ -4,6 +4,7 @@ certifi.py
7 This module returns the installation location of cacert.pem or its contents.
13 @@ -11,12 +12,21 @@ def exit_cacert_ctx() -> None:
14 _CACERT_CTX.__exit__(None, None, None) # type: ignore[union-attr]
17 +def get_cacert_path_from_environ():
18 + path = os.environ.get("NIX_SSL_CERT_FILE", None)
20 + if path == "/no-cert-file.crt":
26 if sys.version_info >= (3, 11):
28 from importlib.resources import as_file, files
32 + _CACERT_PATH = get_cacert_path_from_environ()
35 # This is slightly terrible, but we want to delay extracting the file
36 @@ -44,6 +54,8 @@ if sys.version_info >= (3, 11):
39 def contents() -> str:
40 + if _CACERT_PATH is not None:
41 + return open(_CACERT_PATH, encoding="utf-8").read()
42 return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
44 elif sys.version_info >= (3, 7):
45 @@ -51,7 +63,7 @@ elif sys.version_info >= (3, 7):
46 from importlib.resources import path as get_path, read_text
50 + _CACERT_PATH = get_cacert_path_from_environ()
53 # This is slightly terrible, but we want to delay extracting the
54 @@ -80,7 +92,9 @@ elif sys.version_info >= (3, 7):
57 def contents() -> str:
58 - return read_text("certifi", "cacert.pem", encoding="ascii")
59 + if _CACERT_PATH is not None:
60 + return open(_CACERT_PATH, encoding="utf-8").read()
61 + return read_text("certifi", "cacert.pem", encoding="utf-8")
65 @@ -90,6 +104,8 @@ else:
66 Package = Union[types.ModuleType, str]
67 Resource = Union[str, "os.PathLike"]
69 + _CACERT_PATH = get_cacert_path_from_environ()
71 # This fallback will work for Python versions prior to 3.7 that lack the
72 # importlib.resources module but relies on the existing `where` function
73 # so won't address issues with environments like PyOxidizer that don't set
74 @@ -108,7 +124,13 @@ else:
76 f = os.path.dirname(__file__)
78 + if _CACERT_PATH is not None:
81 return os.path.join(f, "cacert.pem")
83 def contents() -> str:
84 + if _CACERT_PATH is not None:
85 + with open(_CACERT_PATH, encoding="utf-8") as data:
87 return read_text("certifi", "cacert.pem", encoding="ascii")