urllib.request could use the default CA store

Lib/test/test_urllib2_localnet.py

 #!/usr/bin/env python3
 
 import os
 import email
 import urllib.parse
 import urllib.request
 import http.server
 import unittest
 import hashlib
 from test import support
@@ skipping 436 matching lines @@
     def test_200_with_parameters(self):
         expected_response = b"pycon 2008..."
         handler = self.start_server([(200, [], expected_response)])
         data = self.urlopen("http://localhost:%s/bizarre" % handler.port,
                              b"get=with_feeling")
         self.assertEqual(data, expected_response)
         self.assertEqual(handler.requests, ["/bizarre", b"get=with_feeling"])
 
     def test_https(self):
         handler = self.start_https_server()
-        data = self.urlopen("https://localhost:%s/bizarre" % handler.port)
+        data = self.urlopen("https://localhost:%s/bizarre" % handler.port, cadefault=False)
         self.assertEqual(data, b"we care a bit")
 
     def test_https_with_cafile(self):
         handler = self.start_https_server(certfile=CERT_localhost)
         import ssl
         # Good cert
         data = self.urlopen("https://localhost:%s/bizarre" % handler.port,
                             cafile=CERT_localhost)
         self.assertEqual(data, b"we care a bit")
         # Bad cert
         with self.assertRaises(urllib.error.URLError) as cm:
             self.urlopen("https://localhost:%s/bizarre" % handler.port,
                          cafile=CERT_fakehostname)
         # Good cert, but mismatching hostname
         handler = self.start_https_server(certfile=CERT_fakehostname)
         with self.assertRaises(ssl.CertificateError) as cm:
             self.urlopen("https://localhost:%s/bizarre" % handler.port,
                          cafile=CERT_fakehostname)
+
+    def test_https_with_cadefault(self):
+        handler = self.start_https_server(certfile=CERT_localhost)
+        # Self-signed cert should fail verification with system certificate store
+        with self.assertRaises(urllib.error.URLError) as cm:
+            self.urlopen("https://localhost:%s/bizarre" % handler.port)
 
     def test_sending_headers(self):
         handler = self.start_server()
         req = urllib.request.Request("http://localhost:%s/" % handler.port,
                                      headers={"Range": "bytes=20-39"})
         urllib.request.urlopen(req)
         self.assertEqual(handler.headers_received["Range"], "bytes=20-39")
 
     def test_basic(self):
         handler = self.start_server()
@@ skipping 69 matching lines @@
                              (index, len(lines[index]), len(line)))
         self.assertEqual(index + 1, len(lines))
 
 
 @support.reap_threads
 def test_main():
     support.run_unittest(ProxyAuthTests, TestUrlopen)
 
 if __name__ == "__main__":
     test_main()