Add ability to customize certificate CA path or CA bundle

[tyler-8]

Is your feature request related to a problem? Please describe.
Currently, the Smartsheet Python SDK does not provide a way to customize the certificate CA path or CA bundle used for HTTPS requests. This limits the flexibility needed for environments with custom CA requirements or security policies. As a workaround, users must resort to monkey-patching SSL adapter logic, such as:

import os
import ssl
import certifi
import smartsheet

from smartsheet.session import _SSLAdapter
from urllib3.poolmanager import PoolManager


def get_requests_ca_bundle() -> str:
    """Returns the path to the requests CA Bundle, if not set, then returns the default location from certifi."""
    return os.getenv("REQUESTS_CA_BUNDLE", certifi.where())

def init_poolmanager(self, connections, maxsize, block=False):
    """A quick monkey-patching solution to force the SmartSheet client to use the requests CA Bundle for certs instead of the default certifi location."""
    self.poolmanager = PoolManager(
        num_pools=connections,
        maxsize=maxsize,
        block=block,
        cert_reqs=ssl.CERT_REQUIRED,
        ca_certs=get_requests_ca_bundle(),
        ssl_context=self.create_ssl_context(),
    )


_SSLAdapter.init_poolmanager = init_poolmanager

client = smartsheet.Smartsheet(access_token='sometoken')

Describe the solution you'd like
I'd like the SDK to support an option for specifying a custom CA path or CA bundle natively, rather than requiring a monkey-patch or hack. This should be configurable through client initialization or API settings.

Additional context
The issue impacts teams in restricted environments, automation, and CI/CD scenarios. Most other Python SDKs provide settings for this, such as allowing a ca_certs parameter or environment variable for certificate customization. The lack of support can be a security and usability risk.

Environment (please complete the following information):

• OS: Ubuntu 24
• Smartsheet API Version N/A
• Smartsheet Python SDK Version 3.1.0
• Python Version 3.12

[ChrisTowles]

Additional Steps Required for ZScaler/Corporate Proxy SSL Support

I implemented the workaround suggested in this issue for our environment using ZScaler, and found that additional steps are required beyond the basic monkey-patch to make it work correctly.

The Problem

The basic monkey-patch approach from the issue worked for initialization, but SSL verification still failed with:

SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

The Solution

Two critical steps were needed:

1. Combined CA Bundle

ZScaler intercepts SSL connections and presents its own certificate. You need a combined CA bundle that includes:

• Your corporate proxy certificates (ZScaler, etc.)
• System default CA certificates (from certifi)

# Create combined bundle
cat /path/to/zscaler-certs.crt $(python -c "import certifi; print(certifi.where())") > /tmp/combined-ca-bundle.crt

# Set environment variable
export REQUESTS_CA_BUNDLE=/tmp/combined-ca-bundle.crt

2. Load CA Bundle into SSL Context

The key fix: explicitly load the CA bundle into the SSL context using ctx.load_verify_locations(). Without this step, the SSL context doesn't properly use the custom CA bundle.

Working Code

import os
import ssl

import certifi
import smartsheet
from smartsheet.session import _SSLAdapter
from urllib3.poolmanager import PoolManager


def get_ca_bundle() -> str:
    """Get the CA bundle path for SSL certificate verification."""

    # Try REQUESTS_CA_BUNDLE (standard for requests library)
    ca_bundle = os.getenv("REQUESTS_CA_BUNDLE")
    if ca_bundle:
        return ca_bundle

    raise FileNotFoundError("No valid CA bundle found")
    


def init_poolmanager_with_ca_bundle(
    self: _SSLAdapter, connections: int, maxsize: int, block: bool = False
) -> None:
    """
    Custom pool manager initializer with custom CA bundle support.

    Required for corporate proxies like ZScaler that intercept SSL connections.
    """
    ca_bundle = get_ca_bundle()

    # Create SSL context with custom CA bundle
    ctx = self.create_ssl_context()

    # CRITICAL: Load the CA bundle into the SSL context
    # Without this, the context won't properly use the custom certificates
    ctx.load_verify_locations(cafile=ca_bundle)

    self.poolmanager = PoolManager(
        num_pools=connections,
        maxsize=maxsize,
        block=block,
        cert_reqs=ssl.CERT_REQUIRED,
        ca_certs=ca_bundle,
        ssl_context=ctx,
    )


# Apply the monkey-patch BEFORE creating the Smartsheet client
_SSLAdapter.init_poolmanager = init_poolmanager_with_ca_bundle

# Now create the client - it will use the custom CA bundle
client = smartsheet.Smartsheet(access_token="your-token")

ctx.load_verify_locations(): The SSL context needs to explicitly load the CA bundle. Just passing ca_certs to PoolManager isn't sufficient - the context also needs to be aware of the certificates.

Environment

• Smartsheet Python SDK: 3.5.4
• Python: 3.13.3
• Corporate Proxy: ZScaler (transparent SSL interception)
• OS: macOS 14.6 (but should work on Linux/Windows too)

Request for Native Support

This workaround is functional but fragile. Native support for custom CA certificates would be greatly appreciated, either through:

• A ca_bundle parameter in Smartsheet() constructor
• Automatic detection of REQUESTS_CA_BUNDLE or SSL_CERT_FILE environment variables
• A configuration option to pass custom SSL context

This would make the SDK much more usable in enterprise environments with corporate proxies.

---

Hope this helps others encountering the same issue! Let me know if you need any clarification.