create_ssl_context: raise when verify is a str and cert is provided

src/httpx2/httpx2/_config.py

@@ -42,27 +42,28 @@ def create_ssl_context(
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         ctx.check_hostname = False
         ctx.verify_mode = ssl.CERT_NONE
-    elif isinstance(verify, str):  # pragma: nocover
+    elif isinstance(verify, str):
         message = (
             "`verify=<str>` is deprecated. "
             "Use `verify=ssl.create_default_context(cafile=...)` "
             "or `verify=ssl.create_default_context(capath=...)` instead."
         )
         warnings.warn(message, DeprecationWarning)
         if os.path.isdir(verify):
-            return ssl.create_default_context(capath=verify)
-        return ssl.create_default_context(cafile=verify)
+            ctx = ssl.create_default_context(capath=verify)  # pragma: nocover
+        else:
+            ctx = ssl.create_default_context(cafile=verify)
     else:
         ctx = verify
 
-    if cert:  # pragma: nocover
+    if cert:
         message = (
             "`cert=...` is deprecated. Use `verify=<ssl_context>` instead,"
             "with `.load_cert_chain()` to configure the certificate chain."
         )
         warnings.warn(message, DeprecationWarning)
         if isinstance(cert, str):
-            ctx.load_cert_chain(cert)
+            ctx.load_cert_chain(cert)  # pragma: nocover
         else:
             ctx.load_cert_chain(*cert)
 

tests/httpx2/test_config.py

@@ -83,6 +83,15 @@ def test_load_ssl_config_no_verify() -> None:
     assert context.check_hostname is False
 
 
+def test_create_ssl_context_verify_str_with_cert(
+    cert_pem_file: str, cert_private_key_file: str, tmp_path: Path
+) -> None:
+    """Cert chain is applied even when `verify` is given as a string path."""
+    missing = str(tmp_path / "missing.pem")
+    with pytest.warns(DeprecationWarning), pytest.raises(OSError):
+        httpx2.create_ssl_context(verify=cert_pem_file, cert=(missing, missing))
+
+
 def test_SSLContext_with_get_request(server: TestServer, cert_pem_file: str) -> None:
     context = httpx2.create_ssl_context()
     context.load_verify_locations(cert_pem_file)