The running time of the load_verify_locations functions of the SSL module using the cafile and cadata parameters is quite different.

Bug report

Bug description:

The running time of the load_verify_locations functions of the SSL module using the cafile and cadata parameters is quite different.
The cafile parameter takes much more time to run than the cadata.

import ssl
import time
import certifi

from pathlib import Path

DEFAULT_CA_BUNDLE_PATH = Path(certifi.where())
print(DEFAULT_CA_BUNDLE_PATH)
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

start = time.time()
context.load_verify_locations(cafile=DEFAULT_CA_BUNDLE_PATH)
end = time.time()
print(end - start)

start = time.time()
cdata = open(DEFAULT_CA_BUNDLE_PATH, 'r', encoding='utf-8').read()
context.load_verify_locations(cadata=cdata)
end = time.time()
print(end - start)

out :

C:\Program Files\Python311\Lib\site-packages\certifi\cacert.pem
0.5879108905792236
0.06105494499206543

CPython versions tested on:

3.11

Operating systems tested on:

Windows

在 Windows 上使用 Python 3.11 重现所提供的脚本，比较将 certifi cacert.pem 路径作为 cafile 传入与将其内容作为 cadata 传入时的 SSLContext.load_verify_locations。从 SSL 模块入口点开始，确定这两次调用在运行时产生差异的原因；当原因得到解释，并且行为得到修正或记录，同时为该比较提供覆盖时，即视为完成。