The running time of the load_verify_locations functions of the SSL module using the cafile and cadata parameters is quite different.

Bug report

Bug description:

The running time of the load_verify_locations functions of the SSL module using the cafile and cadata parameters is quite different.
The cafile parameter takes much more time to run than the cadata.

import ssl
import time
import certifi

from pathlib import Path

DEFAULT_CA_BUNDLE_PATH = Path(certifi.where())
print(DEFAULT_CA_BUNDLE_PATH)
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

start = time.time()
context.load_verify_locations(cafile=DEFAULT_CA_BUNDLE_PATH)
end = time.time()
print(end - start)

start = time.time()
cdata = open(DEFAULT_CA_BUNDLE_PATH, 'r', encoding='utf-8').read()
context.load_verify_locations(cadata=cdata)
end = time.time()
print(end - start)

out :

C:\Program Files\Python311\Lib\site-packages\certifi\cacert.pem
0.5879108905792236
0.06105494499206543

CPython versions tested on:

3.11

Operating systems tested on:

Windows

在 Windows 上使用 Python 3.11 重現所提供的指令碼，比較將 certifi cacert.pem 路徑作為 cafile 傳入與將其內容作為 cadata 傳入時的 SSLContext.load_verify_locations。從 SSL 模組進入點開始，確定這兩次呼叫在執行時產生差異的原因；當原因得到解釋，且行為得到修正或記錄，同時為該比較提供涵蓋時，即視為完成。