From 0f05751f3911b515e002b083362b9316c5f19ae0 Mon Sep 17 00:00:00 2001
From: Adrian Nembach <adrian.nembach@knime.com>
Date: Wed, 18 Mar 2026 14:02:28 +0100
Subject: [PATCH 1/2] AP-24844: Make AP cacerts the default

---
 .../java/org/knime/python3/PythonCaCertsMode.java  | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java b/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java
index 7571855d1..290c5c694 100644
--- a/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java
+++ b/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java
@@ -73,20 +73,20 @@
  * Controls how the the CAs that Python trusts when using SSL are determined. The mode can be set via the system
  * property {@code knime.python.cacerts} which can be set to either {@link PythonCaCertsMode#ENV} to trust the CAs of
  * the Python environment or {@link PythonCaCertsMode#AP} to trust the CAs that the AP trusts. The property match is
- * done case-insensitive and defaults to ENV, also if the property isn't set at all.
+ * done case-insensitive and defaults to AP, also if the property isn't set at all.
  *
  * @author Adrian Nembach, KNIME GmbH, Konstanz, Germany
  */
 @SuppressWarnings("javadoc")
 enum PythonCaCertsMode {
         /**
-         * Trust the CAs of the Python environment. This is the default behavior.
+         * Trust the CAs of the Python environment.
          */
         ENV(e -> {
             // leave as is
         }),
         /**
-         * Trust the CAs that the AP trusts. Creates a .crt file with the CAs that Java trusts and points the
+         * Trust the CAs that the AP trusts. This is the default behavior. Creates a .crt file with the CAs that Java trusts and points the
          * following environment variables to it:
          * <ul>
          * <li>{@code REQUESTS_CA_BUNDLE}: Respected by requests, httpx and packages that use them.
@@ -107,11 +107,11 @@ enum PythonCaCertsMode {
     private static final Set<String> CA_CERT_ENV_VARS = Set.of("REQUESTS_CA_BUNDLE", "SSL_CERT_FILE");
 
     static PythonCaCertsMode fromProperty() {
-        var property = System.getProperty(PYTHON_CACERTS_PROPERTY, PythonCaCertsMode.ENV.name());
-        if (AP.name().equalsIgnoreCase(property)) {
-            return AP;
+        var property = System.getProperty(PYTHON_CACERTS_PROPERTY, PythonCaCertsMode.AP.name());
+        if (ENV.name().equalsIgnoreCase(property)) {
+            return ENV;
         }
-        return ENV;
+        return AP;
     }
 
     void updateEnvironment(final Map<String, String> environment) {

From 7b534a4466d0944a1b0fd77e8c66b66f162e3204 Mon Sep 17 00:00:00 2001
From: Carsten Haubold <carsten.haubold@knime.com>
Date: Thu, 19 Mar 2026 08:56:07 +0000
Subject: [PATCH 2/2] AP-24844: Log warning if the cacert property is set to an
 invalid value

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../org/knime/python3/PythonCaCertsMode.java     | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java b/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java
index 290c5c694..5b337757d 100644
--- a/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java
+++ b/org.knime.python3/src/main/java/org/knime/python3/PythonCaCertsMode.java
@@ -95,6 +95,8 @@ enum PythonCaCertsMode {
          */
         AP(PythonCaCertsMode::overwriteWithAPCerts);
 
+    private static final NodeLogger LOGGER = NodeLogger.getLogger(PythonCaCertsMode.class);
+
     private final Consumer<Map<String, String>> m_envModifier;
 
     PythonCaCertsMode(final Consumer<Map<String, String>> envModifier) {
@@ -107,10 +109,22 @@ enum PythonCaCertsMode {
     private static final Set<String> CA_CERT_ENV_VARS = Set.of("REQUESTS_CA_BUNDLE", "SSL_CERT_FILE");
 
     static PythonCaCertsMode fromProperty() {
-        var property = System.getProperty(PYTHON_CACERTS_PROPERTY, PythonCaCertsMode.AP.name());
+        final String property = System.getProperty(PYTHON_CACERTS_PROPERTY);
+        if (property == null) {
+            // property not set: default to AP
+            return AP;
+        }
+        if (AP.name().equalsIgnoreCase(property)) {
+            return AP;
+        }
         if (ENV.name().equalsIgnoreCase(property)) {
             return ENV;
         }
+        LOGGER.warnWithFormat(
+            "Invalid value '%s' for system property '%s'. Falling back to '%s'.",
+            property,
+            PYTHON_CACERTS_PROPERTY,
+            AP.name());
         return AP;
     }