Reading `cafile` from `ssl.create_default_context` causes ~143,000 disk operations in Windows

[sloweclair]

Bug report

Bug description:

When running the code below it causes ~143,000 disk operations to read in the entire file. This is because it is doing 2 bytes at a time for some reason.

import ssl
import certifi

ssl.create_default_context(cafile=certifi.where())

How to replicate

1. Download & Run Procmon https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
2. Make sure you aren't running any other Python code to make the capture easier
3. In the filter window have it filter for Process Name contains python

4. Make sure Procmon is capturing
5. Run the python program above
6. Observe all the disk operations

If reading the file normally with open then it behaves as expected and only does a handful of calls

CPython versions tested on:

3.13

Operating systems tested on:

Windows

Linked PRs

• gh-137560: Speed up ssl.create_default_context() on Windows #137596

[StanFromIreland]

I cannot reproduce on Linux, perf reports:

    30.965 ( 0.002 ms): python3.15/7064 read(fd: 3, buf: 0x3dc6b290, count: 4096)                             = 4096

[picnixz]

That's weird because we delegate the task of loading the certfile to load_verify_locations which itself delegates to SSL_CTX_load_verify_locations which is an SSL function:

cpython/Modules/_ssl.c

Lines 4719 to 4721 in d7dbde8

	PySSL_BEGIN_ALLOW_THREADS(self)
	r = SSL_CTX_load_verify_locations(self->ctx, cafile_buf, capath_buf);
	PySSL_END_ALLOW_THREADS(self)

. So we can't do more here I think?

[serhiy-storchaka]

This may be the result of the solution for #79846.

If I remember correctly, it was discussed the possibility to keep a fast path for the case if all certificates are correct, but no significant performance difference was noticed. How much time does it take?

[sloweclair]

@serhiy-storchaka I think you are correct

With this code as the test

import ssl
import certifi
from time import process_time

t = process_time()
ssl.create_default_context(cafile=certifi.where())
elapsed_time = process_time() - t

print(elapsed_time)

Python 3.11.3 - 0.0
Python 3.11.9 and later - 0.078125 - 0.109375

While 100ms might not seem like that much it really adds up when programs are multithreaded/process and using different requests/httpx/etc clients