[shrutiburman]

What

Ports the twilio-java distrust-emudhra-intermediates check to twilio-python. A connection is refused if any certificate in its TLS chain has an SPKI SHA-256 hash among the 8 distrusted intermediates (same list as Go 1.27.3 / 1.26.10, CVE-2026-111943, golang/go#82345).

• New twilio/http/distrusted_intermediates.py: DistrustedIntermediatesAdapter and mount_distrusted_intermediates_check(session).
• TwilioHttpClient and ValidationClient apply it by default. A custom requests session has to opt in (README section added).
• Python 3.7–3.9 can't read the chain from the standard library, so setup.py adds pyOpenSSL for python_version < "3.10".

Behaviour differs by Python version

• 3.10+: checks the verified chain (root included).
• 3.7–3.9: checks the chain the server sent (usually no root), as the Java SDK does.
• If a chain can't be read, the check is skipped with a one-time warning.

[shrutiburman]

locally tested with one blacklisted cert-

[sudhirnarayana]

Suggestion: use this exact message so all SDKs and the CLI match: Certificate chain which you are using contains a distrusted intermediate certificate

twilio-node (#1223), twilio-csharp (#861) and twilio-cli (#738) already use it. One string lets customers, support and docs search for the same error in every language.

[sudhirnarayana]

Suggestion: use this exact message so all SDKs and the CLI match: Certificate chain which you are using contains a distrusted intermediate certificate

twilio-node (#1223), twilio-csharp (#861) and twilio-cli (#738) already use it. One string lets customers, support and docs search for the same error in every language.

How: change the DistrustedIntermediateError message here. The test uses assertIn("distrusted intermediate", ...), so it should still pass.