PYTHON-5040 Only use PROTOCOL_TLS_CLIENT in http_post on macOS

Author: blink1073

test/asynchronous/test_encryption.py

@@ -3045,12 +3045,16 @@ async def asyncSetUp(self):
     async def http_post(self, path, data=None):
         # Note, the connection to the mock server needs to be closed after
         # each request because the server is single threaded.
-        # Use PROTOCOL_TLS_CLIENT instead of create_default_context so that
-        # X509_V_FLAG_X509_STRICT is not set.  Python 3.14 enables strict mode
-        # in create_default_context, which requires SKI on the root CA cert.
-        # We intentionally omit SKI from the CA cert to prevent macOS SecTrust
-        # from triggering OCSP revocation checks during MongoDB server startup.
-        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        if sys.platform == "darwin":
+            # macOS: use PROTOCOL_TLS_CLIENT instead of create_default_context
+            # so that X509_V_FLAG_X509_STRICT is not set.  Python 3.14 enables
+            # strict mode in create_default_context, which requires SKI on the
+            # root CA cert.  We intentionally omit SKI from the CA cert to
+            # prevent macOS SecTrust from triggering OCSP revocation checks
+            # during MongoDB server startup.
+            ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        else:
+            ctx = ssl.create_default_context()
         ctx.load_verify_locations(cafile=CA_PEM)
         ctx.load_cert_chain(CLIENT_PEM)
         conn = http.client.HTTPSConnection("127.0.0.1:9003", context=ctx)

test/test_encryption.py

@@ -3027,12 +3027,16 @@ def setUp(self):
     def http_post(self, path, data=None):
         # Note, the connection to the mock server needs to be closed after
         # each request because the server is single threaded.
-        # Use PROTOCOL_TLS_CLIENT instead of create_default_context so that
-        # X509_V_FLAG_X509_STRICT is not set.  Python 3.14 enables strict mode
-        # in create_default_context, which requires SKI on the root CA cert.
-        # We intentionally omit SKI from the CA cert to prevent macOS SecTrust
-        # from triggering OCSP revocation checks during MongoDB server startup.
-        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        if sys.platform == "darwin":
+            # macOS: use PROTOCOL_TLS_CLIENT instead of create_default_context
+            # so that X509_V_FLAG_X509_STRICT is not set.  Python 3.14 enables
+            # strict mode in create_default_context, which requires SKI on the
+            # root CA cert.  We intentionally omit SKI from the CA cert to
+            # prevent macOS SecTrust from triggering OCSP revocation checks
+            # during MongoDB server startup.
+            ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        else:
+            ctx = ssl.create_default_context()
         ctx.load_verify_locations(cafile=CA_PEM)
         ctx.load_cert_chain(CLIENT_PEM)
         conn = http.client.HTTPSConnection("127.0.0.1:9003", context=ctx)