The running time of the load_verify_locations functions of the SSL module using the cafile and cadata parameters is quite different.

Bug report

Bug description:

The running time of the load_verify_locations functions of the SSL module using the cafile and cadata parameters is quite different.
The cafile parameter takes much more time to run than the cadata.

import ssl
import time
import certifi

from pathlib import Path

DEFAULT_CA_BUNDLE_PATH = Path(certifi.where())
print(DEFAULT_CA_BUNDLE_PATH)
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

start = time.time()
context.load_verify_locations(cafile=DEFAULT_CA_BUNDLE_PATH)
end = time.time()
print(end - start)

start = time.time()
cdata = open(DEFAULT_CA_BUNDLE_PATH, 'r', encoding='utf-8').read()
context.load_verify_locations(cadata=cdata)
end = time.time()
print(end - start)

out :

C:\Program Files\Python311\Lib\site-packages\certifi\cacert.pem
0.5879108905792236
0.06105494499206543

CPython versions tested on:

3.11

Operating systems tested on:

Windows

Reproduce the supplied script with Python 3.11 on Windows, comparing SSLContext.load_verify_locations with the certifi cacert.pem path passed as cafile versus its contents passed as cadata. Start at the SSL module entry point and determine why the two calls differ in runtime; done means the cause is explained and the behavior is corrected or documented with coverage for the comparison.