Set PycURL's Proxy and Origin CA Bundles Independently

from io import BytesIO
import pycurl

body = BytesIO()
curl = pycurl.Curl()
try:
    curl.setopt(pycurl.URL, "https://api.example/")
    curl.setopt(pycurl.PROXY, "https://proxy.example:8443")
    curl.setopt(pycurl.PROXY_CAINFO, "/path/to/proxy-ca.pem")
    curl.setopt(pycurl.CAINFO, "/path/to/origin-ca.pem")
    curl.setopt(pycurl.CONNECTTIMEOUT, 5)
    curl.setopt(pycurl.TIMEOUT, 30)
    curl.setopt(pycurl.WRITEDATA, body)
    curl.perform()
finally:
    curl.close()

Use a PycURL/libcurl build supporting HTTPS proxies. The bundle paths stand for the intended trust sets: PROXY_CAINFO verifies the intermediary; CAINFO verifies destination TLS. Omit an explicit override when existing trust already covers that connection.

The URL in PROXY describes its listener. No numeric PROXYTYPE guess is needed. For a plain HTTP listener, its URL remains http:// even with an HTTPS destination. In that plain-listener case, the HTTP proxy list supplies endpoint candidates; the proxy TLS bundle applies only when the listener actually uses TLS.

Supply a proxy account through PROXYUSERNAME and PROXYPASSWORD when required. Retain certificate verification: disabling proxy verification removes the intermediary identity check rather than installing the missing authority.