[Question][delivery_correos_express] SSL CERTIFICATE_VERIFY_FAILED against test endpoint (www.test.cexpr.es)

[madisi98]

Module

delivery_correos_express
Odoo version: 18.0
Module version / commit: be5ec45

Describe the bug

When testing the integration against the Correos Express test environment, requests fail during SSL certificate validation. The test host (www.test.cexpr.es) appears to serve a certificate chain that does not validate against standard public CA bundles — the chain includes a self-signed certificate.

To Reproduce

Configure a Correos Express delivery carrier set to the test environment.
Trigger a shipment creation (which calls grabacionEnvio).

Error

HTTPSConnectionPool(host='www.test.cexpr.es', port=443): Max retries exceeded with url: /wsps/apiRestGrabacionEnviok8s/json/grabacionEnvio (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1000)')))

Expected behavior
Requests against the test endpoint should complete, or the module should provide a documented way to supply a custom CA bundle / handle the test environment's certificate chain.

Additional context

• Has anyone else hit this against www.test.cexpr.es? Is it a known/intermittent issue with their test environment's certificate?
• Does the module expose a hook for a custom CA bundle, or does it rely on the system / certifi trust store and the REQUESTS_CA_BUNDLE environment variable?
• Would the maintainers consider adding an optional, test-environment-only setting to supply a CA bundle (or otherwise document the recommended workaround)?

[Flexigobe]

The CERTIFICATE_VERIFY_FAILED against www.test.cexpr.es is on Correos Express's side, not the module's: their staging host serves an incomplete chain (missing intermediate) and/or a cert that doesn't validate against the public CA bundle — a known annoyance with their test environment, distinct from production (envio.correosexpress.com), which validates fine.

A couple of practical paths:

• Don't disable verification globally. If a fix is wanted in-module, the cleanest is to allow a per-carrier custom CA bundle (verify=<path to a bundle that includes Correos Express's intermediate>) so the test host validates without weakening prod. You can grab the missing intermediate from the chain CE publishes and pin it.
• Quick check that it's purely the chain: fetch the intermediate and point REQUESTS_CA_BUNDLE at a bundle that includes it — verification should then pass. That confirms it's chain-completeness, not the module.
• Worth a README note that the test endpoint needs the extra intermediate, since several people hit this.

For context, I maintain a Correos Express connector for Odoo and ran into the same staging-cert behaviour — happy to share the exact intermediate/bundle setup that makes the test endpoint validate if it helps the fix here.

— Victor (FlexiGoTech)