RHEL/CentOS 7 OpenSSL client compatibility after new chain

[jsha]

@FelixSchwarz

I just want to mention that system applications should be fine but if you deployed a custom Python application which uses requests in a virtualenv your ca-bundle will be provided by certifi and they still provide the expired certificate.

So if your Python application makes outgoing requests and tries to verify the TLS certificate you should pass the path to the system-wide CA bundle.

Good info, @FelixSchwarz! One easy way to do this should be to set the REQUESTS_CA_BUNDLE environment variable.