PYTHON-5040 Clarify comments about macOS SecTrust and cert env vars

Author: blink1073

.github/workflows/test-python.yml

@@ -226,6 +226,8 @@ jobs:
         with:
           ssl: true
         env:
+          # drivers-evergreen-tools invokes run-mongodb.sh directly (not via
+          # run_server.py), so cert paths must be provided explicitly here.
           TLS_PEM_KEY_FILE: ${{ github.workspace }}/test/certificates/server.pem
           TLS_CA_FILE: ${{ github.workspace }}/test/certificates/ca.pem
           TLS_CERT_KEY_FILE: ${{ github.workspace }}/test/certificates/client.pem

test/asynchronous/test_encryption.py

@@ -3049,7 +3049,7 @@ async def http_post(self, path, data=None):
         # X509_V_FLAG_X509_STRICT is not set.  Python 3.14 enables strict mode
         # in create_default_context, which requires SKI on the root CA cert.
         # We intentionally omit SKI from the CA cert to prevent macOS SecTrust
-        # from triggering OCSP revocation checks during MongoDB 4.2 server startup.
+        # from triggering OCSP revocation checks during MongoDB server startup.
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         ctx.load_verify_locations(cafile=CA_PEM)
         ctx.load_cert_chain(CLIENT_PEM)

test/certificates/README.md

@@ -61,6 +61,6 @@ macOS and Windows with Python 3.13+.  The root causes were:
 
 The CA cert intentionally omits SKI even though strict mode would normally require it on all
 certs: adding SKI to the CA triggers macOS SecTrust OCSP revocation checks on the MongoDB server
-startup path (MongoDB 4.2 Enterprise uses Apple SecTrust), causing ~67-second connection
+startup path (MongoDB Enterprise on macOS uses Apple SecTrust), causing ~67-second connection
 timeouts.  KMS connections bypass this by using `ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)` instead
 of `ssl.create_default_context()`, which does not enable strict mode.

test/test_encryption.py

@@ -3031,7 +3031,7 @@ def http_post(self, path, data=None):
         # X509_V_FLAG_X509_STRICT is not set.  Python 3.14 enables strict mode
         # in create_default_context, which requires SKI on the root CA cert.
         # We intentionally omit SKI from the CA cert to prevent macOS SecTrust
-        # from triggering OCSP revocation checks during MongoDB 4.2 server startup.
+        # from triggering OCSP revocation checks during MongoDB server startup.
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         ctx.load_verify_locations(cafile=CA_PEM)
         ctx.load_cert_chain(CLIENT_PEM)