Google Colab Runtime and Python Requests: Custom CA Trust Across Ephemeral VM Sessions

Answer to the question

Google Colab does not expose a supported, documented mechanism that makes a custom CA certificate survive a runtime recycle. All changes to the OS trust store (e.g. files under /usr/local/share/ca-certificates) and to the Python certifi bundle are lost when the VM is disconnected or recycled. Consequently, requests will continue to use the default bundle unless you explicitly re‑install the CA on every new session.

Why the default bundle is not automatically updated

• requests uses certifi.where() to locate its bundled CA file unless the environment variable REQUESTS_CA_BUNDLE overrides it.
• Updating the OS trust store (via update-ca-certificates) does not modify the certifi bundle that requests consults.
• Colab’s runtime image is rebuilt from scratch on each disconnect, so any modifications to /usr/local/share/ca-certificates or to site‑packages/certifi are discarded.

Practical steps to trust a private CA in every Colab session

1. Upload your CA PEM (e.g. my-root-ca.pem) to a persistent location such as Google Drive or store it in the notebook’s working directory.

2. Mount Google Drive if you prefer persistence across sessions:

   from google.colab import drive
   drive.mount('/content/drive')
   

3. Copy the PEM to the OS trust directory and update the store:

   !sudo cp /content/drive/MyDrive/my-root-ca.pem /usr/local/share/ca-certificates/my-root-ca.crt
   !sudo update-ca-certificates
   

4. Ensure requests uses the updated bundle. Two common approaches:

   • Override with an environment variable (affects all Python code in the session):

     import os
     os.environ['REQUESTS_CA_BUNDLE'] = '/etc/ssl/certs/ca-certificates.crt'
     

   • Pass the PEM directly to requests:

     import requests
     response = requests.get('https://internal.api', verify='/usr/local/share/ca-certificates/my-root-ca.pem')
     

5. Optionally, update the certifi bundle itself so that certifi.where() points to a file that contains the custom CA. This is more involved and requires editing the certifi package files, which is less portable across runtime images.

Verification after each startup

• Check the active certifi bundle:

  !python -c "import certifi, os; print(certifi.where()); print(os.getenv('REQUESTS_CA_BUNDLE'))"
  

• Confirm the custom CA is present in the OS trust store:

  !openssl x509 -in /usr/local/share/ca-certificates/my-root-ca.pem -text -noout
  

• Test a request to the internal API and look for a SSL: CERTIFICATE_VERIFY_FAILED error to confirm the CA is being used.

Missing diagnostic detail

To fine‑tune the recommendation, could you confirm whether the CA file is available in a persistent location (e.g. Google Drive) or if you need to generate it on each session? This determines whether you should mount Drive or copy the PEM manually each time.

Key take‑aways

• No built‑in persistence for custom CA certificates across Colab VM restarts.
• Re‑install the CA on every session and point requests to the updated store or a custom PEM.
• Updating certifi is optional and requires modifying the package; using REQUESTS_CA_BUNDLE is simpler and less error‑prone.