# RHEL/CentOS 7 OpenSSL client compatibility after new chain

**URL:** <https://community.letsencrypt.org/t/rhel-centos-7-openssl-client-compatibility-after-new-chain/151969>\
**Category:** Help\
**Created:** [May 18, 2021, 9:07am UTC](https://community.letsencrypt.org/t/rhel-centos-7-openssl-client-compatibility-after-new-chain/151969 "2021-05-18T09:07:14Z")\
**Posts on this page:** 1\
**Showing post:** 31

<div class="post-metadata">

**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\
**Post date:** [October 1, 2021, 6:58pm UTC](https://community.letsencrypt.org/t/rhel-centos-7-openssl-client-compatibility-after-new-chain/151969/31 "2021-10-01T18:58:04Z")

</div>

> [@FelixSchwarz](#):
>
> I just want to mention that system applications should be fine but if you deployed a custom Python application which uses `requests` in a virtualenv your ca-bundle will be provided by `certifi` and they still provide the expired certificate.
> 
> So if your Python application makes outgoing requests and tries to verify the TLS certificate you should pass the path to the system-wide CA bundle.

Good info, @FelixSchwarz! One easy way to do this should be to set the REQUESTS\_CA\_BUNDLE environment variable.

---

_[View the full topic](https://community.letsencrypt.org/t/rhel-centos-7-openssl-client-compatibility-after-new-chain/151969)._