refact: Use ssl context for httpx

Author: kukovecz

onekey_client/client.py

@@ -1,6 +1,7 @@
 import functools
 import gc
 import secrets
+import ssl
 from importlib import resources
 from importlib.metadata import version
 from pathlib import Path
@@ -65,18 +66,36 @@ def _setup_httpx_client(
         ca_bundle: Path | None = None,
         disable_tls_verify: bool | None = False,
     ):
-        headers = {"User-Agent": f"{APP_NAME}/{APP_VERSION}"}
+        return httpx.Client(
+            base_url=api_url,
+            headers={
+                "User-Agent": f"{APP_NAME}/{APP_VERSION}",
+            },
+            verify=self._create_ssl_context(
+                ca_bundle=ca_bundle, disable_tls_verify=disable_tls_verify
+            ),
+        )
+
+    def _create_ssl_context(
+        self,
+        ca_bundle: Path | None,
+        disable_tls_verify: bool | None,
+    ) -> ssl.SSLContext:
         if disable_tls_verify:
-            return httpx.Client(base_url=api_url, headers=headers, verify=False)  # noqa: S501 (TLS certificate validation disabled)
+            context = ssl.create_default_context()
+            context.check_hostname = False
+            context.verify_mode = ssl.CERT_NONE
+            return context
 
         if ca_bundle is not None:
             ca = ca_bundle.expanduser()
             if not ca.exists():
                 raise errors.InvalidCABundle
 
-            return httpx.Client(base_url=api_url, headers=headers, verify=str(ca))
+            return ssl.create_default_context(cafile=str(ca))
+
         with resources.path(keys, "ca.pem") as ca:
-            return httpx.Client(base_url=api_url, headers=headers, verify=str(ca))
+            return ssl.create_default_context(cafile=str(ca))
 
     def _load_key(self, key_name: str, path: Path | None = None):
         if path is not None: