Currently ssl.create_default_context() is called for creation of "ssl context" when making HTTPS requests to ASPSPs. When no parameters are passed, the function will use system's default trusted certificates. This is good for basic verification of server certificates, but doesn't provide enough flexibility. For example, it is not enough for accepting only qualified certificates (if there is such a requirement).
Currently
ssl.create_default_context()is called for creation of "ssl context" when making HTTPS requests to ASPSPs. When no parameters are passed, the function will use system's default trusted certificates. This is good for basic verification of server certificates, but doesn't provide enough flexibility. For example, it is not enough for accepting only qualified certificates (if there is such a requirement).