httpx-pki — PKCS#12/PEM client-certificate (mTLS) sessions; docs listing?

[ccbest]

Hi all — first off, thank you for picking up stewardship of httpx. The transition has been smooth from where I'm sitting as an extension author.

I maintain httpx-pki (PyPI), which fills the gap left when httpx 0.28 deprecated cert= — a design httpx2 keeps — in favor of "build an ssl.SSLContext yourself." That's the right call, but stdlib ssl can't build one from a PKCS#12 bundle or from in-memory bytes, which is what enterprise CAs actually hand people. httpx-pki is that missing piece:

from httpx_pki import PKIClient

with PKIClient("client.p12", password="secret") as client:
    client.get("https://mtls.example.com/")

PKIClient / AsyncPKIClient subclass httpx2.Client / httpx2.AsyncClient directly, so everything else (mounts, transports, timeouts, http2) is just httpx2. There's also a build_ssl_context() helper for people who'd rather mount the context on a plain client or transport.

Some background on the why: I work at a large tech company with a, let's say, loosely coordinated security organization, which means no two internal services hand you credentials the same way. One team issues a password-protected .p12, the next a PEM with the blocks in a creative order, a third says "it's already in the Windows cert store," and a fourth rotates the file under you mid-deploy. After writing the same ssl-context glue for the nth variation, I gave up and put every situation I'd been burned by into one library, and then asked Claude to help me cover down on all the other variants that haven't burned me yet but probably will in the future. So httpx-pki handles the messier corners of client-cert work as first-class cases: PKCS#12 / PEM / separate key+cert / PKCS#7 with content-based format detection, multi-identity bundles (e.g. Entrust/PIV dual key pairs) with key-usage selection, loading from the Windows cert store and macOS keychain, certificate rotation via auto_reload, 12-factor env config, and keeping decrypted keys off disk (memfd on Linux).

httpx-pki is MIT, typed, tested on 3.10–3.14 across all three platforms.

On httpx2 specifically: httpx2 will the required dependency in the future 0.8 release (with original-httpx still supported as a fallback), and the verify=True default follows httpx2's truststore-backed behavior, so trust semantics match what httpx2 users already expect.

The ask: would you consider adding httpx-pki to the Third Party Packages page (under Plugins)? Happy to open the docs PR myself if you're open to it — proposed entry:

httpx-pki

GitHub

PKCS#12 / PEM client-certificate (mTLS) sessions, with OS cert-store
loading, identity selection, and certificate rotation.

Feedback on the library itself is of course welcome too. Thanks!

[Kludex]

Yes, sure. PR welcome to add docs on third party.