GeezerVison

This documents that SSLContext.load_verify_locations() accepts CRLs only through cafile or capath, not through cadata.

cafile/capath are passed to OpenSSL's SSL_CTX_load_verify_locations, which loads CRLs in addition to certificates. cadata, on the other hand, is handled by _add_ca_certs in Modules/_ssl.c, which reads X.509 certificates only (d2i_X509_bio / PEM_read_bio_X509 + X509_STORE_add_cert). Supplying a CRL through cadata therefore raises SSLError: "cadata does not contain a certificate" rather than loading it.

The docs previously stated that the method "can also load certification revocation lists (CRLs)" without noting this restriction.

• Issue: SSLContext.load_verify_locations(cadata=...) does not accept CRLs (unlike cafile and capath) #149679