The silent update-check failure: urllib, HTTPS inspection, and truststore

What happened

Simple Account Balancer checks GitHub for a newer release on startup. On some machines the check failed while the same machine’s browser reached GitHub without trouble. The first version of the code failed without saying why: the user saw nothing, and no reason was recorded.

Root cause

Python’s default certificate verification does not consult the Windows certificate store the way a native app or the browser does. When antivirus or a network filter inspects HTTPS, it installs its own root certificate that Windows trusts, so the browser accepts the connection. Python’s verification does not honor that same trust, so it rejects the connection with a certificate error. The browser and the app disagree because they are checking against different trust stores. The app’s own code comment names the problem: it switches to “the Windows certificate store for TLS instead of the bundled CA list, so antivirus/network filters that inject their own root cert (common on managed laptops) don’t break the GitHub update check.”

The artifact

The connection raised ssl.SSLCertVerificationError, wrapped in a urllib.error.URLError. The fix turns that specific cause into a message the user can act on:

if isinstance(cause, ssl.SSLCertVerificationError):
    return (
        "GitHub's certificate could not be verified. This usually means "
        "antivirus or a network filter is inspecting HTTPS traffic."
    )

The trust-source fix routes verification through the Windows store before any request is made:

try:
    import truststore
    truststore.inject_into_ssl()
except Exception:
    pass

Two ways it failed silently

The first was the trust store itself. Until truststore was added, a certificate-inspecting filter broke the check and the app said nothing.

The second is the reason the try/except above is dangerous on its own. PyInstaller does not detect truststore as a dependency, because nothing imports it at module load: it is imported inside main(). Without an explicit --hidden-import truststore in the build, the frozen app ships without truststore, the import fails, the bare except swallows the failure, and Python quietly falls back to its default verification. The fix that was supposed to be there is silently absent, and everything looks normal until a filtered network hits it.

The fix

Three parts, in order:

• truststore.inject_into_ssl(), so verification uses the Windows certificate store, which already trusts the filter’s root.
• --hidden-import truststore in the build script, so the frozen app actually contains truststore instead of silently doing without it.
• A real error path, so the update check reports the certificate failure in plain language instead of failing quietly. That is what makes the problem findable at all.

Evidence boundary

truststore changes which trust store is consulted. It does not defeat a filter that blocks the connection outright rather than inspecting it, and this path is Windows-specific. The update check only reports that a newer release exists. It never downloads or installs anything, so a failed check delays a notice rather than breaking the app.

Source ledger