Problem Statement

The SDK currently exposes a ca_certs variable that allows setting the certificate bundle file for HTTPS cert verification within the SDK itself (for certs presented by the Sentry server) - this is useful for corporate proxies doing HTTPS hijacking or self-hosted instances with certs issued under internal CAs. Unfortunately, this requires modifying the Sentry SDK integration to point to the required CA bundle file.

Requests uses the REQUESTS_CA_BUNDLE environment variable to point at a certificate bundle with no code modification. Lots of software, including python-httpx, supports the SSL_CERT_FILE env var to do the same thing.

Solution Brainstorm

If ca_certs is not set, the SDK could evaluate SSL_CERT_FILE and/or REQUESTS_CA_BUNDLE variables for a CA bundle path, before falling back to Certifi (which ships an embedded Mozilla CA bundle file).

I'd like to send a PR to add this, but wanted to ask if this is something you'd accept first.