What Martin said is correct, IMO.

The actual problem I'd like to correct is: If I - for example - create an HTTPSConnection with cert validation enabled, and set to use the default OS trust mechanism, then the validation process should trigger Windows' root CA download mechanism if necessary (i.e. rather than just rejecting the CA cert if it hasn't already been locally cached).

I don't expect that ssl.enum_certificates() ever will return all the certificates that are (implicitly, via the update mechanism) trusted by Windows; that's probably not feasible. I chose that as the title of the issue because it seemed to be the most concrete root-cause, but maybe that wasn't ideal.

(I'll file a separate issue for that traceback I ran into, if I get a chance to dig into it more)