---
id: wassima
version: "2.1.3"
license: MIT
license_treatment: permissive
maintenance: active
---

# wassima — Access your OS root certificates with utmost ease

License: permissive · Maintenance: active · Downloads: 2.0M/mo

## What it is and what it does

Wassima is a certificate store abstraction layer that reads your operating system's root CA certificates and makes them available in multiple formats (SSL context, DER, PEM, or concatenated bundle). It automatically falls back to an embedded CCADB-sourced trust store when the OS provides nothing, and supports a hybrid mode that combines both for environments like containers where the system store may be outdated or incomplete. The library caches results for performance (default 12-hour TTL) and deduplicates certificates across multiple OS store locations.

It's designed as a permissive-licensed alternative to certifi, letting you work with your actual system trust store rather than a static bundled copy. You can register additional CAs, control cache behavior, and force hybrid mode when needed. The package works out-of-the-box on any OS and supports Python 3.7+ including PyPy.

Use it for:

- Build HTTPS clients that respect the system's certificate policy without bundling a separate CA store
- Create SSL contexts in containers or appliances where the system trust store is slim or outdated
- Register custom root CAs alongside system certificates for internal PKI environments
- Generate CA bundles for tools that need PEM-format certificate files
- Ensure certificate verification picks up OS-level CA updates without restarting the application

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Wassima provides access to your operating system's root certificate store for SSL/TLS verification, with automatic fallback to an embedded CCADB trust store and optional hybrid mode for containers.

Yes. Wassima is actively maintained, has no dependencies, installs cleanly, carries a permissive MIT license, and solves a real problem—accessing the OS trust store without bundling a static copy. It's a solid drop-in for certifi in projects that want to respect system certificate policy. No known vulnerabilities.

## Install

pip install wassima
uv add wassima
poetry add wassima

## Installing wassima

Before you install: Low friction: pure Python wheel with no runtime dependencies. Actively maintained with a recent release (21 days ago) and last commit on 2026-08-01. Supports Python 3.7+ and PyPy.

License in practice: MIT license (permissive) means you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart:

pip install wassima

import wassima

ctx = wassima.create_default_ssl_context()
# ctx now contains your system root CAs

bundle = wassima.generate_ca_bundle()
# bundle is a string with all root CAs in PEM format

Requires Python 3.7 or later; PyPy is supported.

Verify before relying:

- Whether the embedded CCADB bundle is updated regularly and how frequently
- Performance characteristics when hybrid_store=True on systems with large trust stores
- Exact behavior of the 3-year staleness check on Linux/BSD systems

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 2.0M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

os root certificates ssl, system ca store access, ssl context from os trust, certifi alternative, certificate bundle generation, tls certificate verification, hybrid ca store, certificate-management, ssl-tls, system-integration

[View on SkillFed](https://skillfed.io/packages/wassima) · [View on PyPI](https://pypi.org/project/wassima/)