Configure the default Linux SSL context once instead of per handshake

[Kludex]

Closes #1252.

On Linux, truststore.SSLContext calls set_default_verify_paths() on its shared inner context before every handshake. OpenSSL < 3.4 appends a duplicate CApath lookup on each call, so issuer lookups grow quadratically and CPU climbs over the lifetime of a reused client (sethmlarson/truststore#212).

On Linux, the default context is now a stdlib ssl.SSLContext configured once, with the same logic truststore uses there (its Linux backend delegates verification to OpenSSL anyway). Windows and macOS still use truststore. httpx2.create_ssl_context() now uses httpcore2.default_ssl_context() instead of duplicating it, passing trust_env through a private _trust_env keyword. With trust_env=False, SSL_CERT_FILE/SSL_CERT_DIR are ignored. The private keyword goes away together with the Linux branch.

Measured on Debian bookworm (OpenSSL 3.0.22), against a server with an intermediate chain:

	before	after
CPU per request, 4 batches of 100	23 → 27 → 32 → 36 ms	1.4 ms, flat
/usr/lib/ssl/certs opens for 5 / 20 / 50 requests	20 / 230 / 1325	6 / 21 / 51

Verification is still enforced: an untrusted chain fails with CERTIFICATE_VERIFY_FAILED, and system CAs still validate public hosts.

This can be reverted once sethmlarson/truststore#213 is released.

AI Disclaimer

This PR was developed with the assistance of either Claude or Codex. I've reviewed and verified the changes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T12:32:44.254418Z	478e923	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codspeed]

Merging this PR will not alter performance

✅ 17 untouched benchmarks
⏩ 7 skipped benchmarks¹

---

_{Comparing configure-linux-ssl-context-once (5606fb4) with main (53c11c4)}

Footnotes

1. 7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 478e923fe9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>