OpenAI's Python SDK moves to HTTPX2, quietly changing how it trusts certificates

The OpenAI Python SDK now ships HTTPX2 as the engine behind its synchronous and asynchronous HTTP clients, replacing the older httpx package, which is no longer pulled in as a transitive dependency. For the common case, nothing changes: code that creates an OpenAI or AsyncOpenAI client without a custom http_client keeps working, including streaming, retries, auth, parsed response models, and numeric timeouts. The catch is for anyone who leaned on httpx being installed for free — they now need to declare it themselves or move to httpx2.

The most consequential change is invisible until it breaks something. HTTPX2 abandons the bundled certifi CA set and instead validates TLS certificates against the operating system’s trust store, and the SDK no longer installs certifi at all. That silently breaks certificate verification in three common setups: stripped-down container images without system CA certs, corporate environments running TLS-inspecting proxies, and any deployment that depended on a customized certifi bundle. Fixes involve installing CA certs into the OS trust store, pointing SSL_CERT_FILE or SSL_CERT_DIR at a bundle, or passing an explicit ssl.SSLContext through a DefaultHttpx2Client.

The rest of the migration is a type-and-transport swap. Custom transports, auth handlers, event hooks, and raw-response casts now deal in httpx2 objects rather than httpx ones, so third-party tracing, mocking, and auth integrations must add HTTPX2 support. Test suites using RESPX need an HTTPX2-compatible version to intercept the default client. A legacy escape hatch remains — install httpx and inject a legacy client — but it’s runtime-only, fails static type checking without a cast(Any, …) workaround, and OpenAI warns it may be removed. In short, most users can upgrade untouched, but anyone with strict TLS environments or heavy HTTP-layer customization should plan for real work.