Set verify_certs default to True

If certifi is installed use it as default for ca_certs value
Closes #403

elasticsearch/connection/http_requests.py

@@ -27,7 +27,7 @@ class RequestsHttpConnection(Connection):
     :arg headers: any custom http headers to be add to requests
     """
     def __init__(self, host='localhost', port=9200, http_auth=None,
-        use_ssl=False, verify_certs=False, ca_certs=None, client_cert=None,
+        use_ssl=False, verify_certs=True, ca_certs=None, client_cert=None,
         client_key=None, headers=None, **kwargs):
         if not REQUESTS_AVAILABLE:
             raise ImproperlyConfigured("Please install requests to use RequestsHttpConnection.")

elasticsearch/connection/http_urllib3.py

@@ -3,6 +3,14 @@ import urllib3
 from urllib3.exceptions import ReadTimeoutError, SSLError as UrllibSSLError
 import warnings
 
+CA_CERTS = None
+
+try:
+    import certifi
+    CA_CERTS = certifi.where()
+except ImportError:
+    pass
+
 from .base import Connection
 from ..exceptions import ConnectionError, ImproperlyConfigured, ConnectionTimeout, SSLError
 from ..compat import urlencode
@@ -36,7 +44,7 @@ class Urllib3HttpConnection(Connection):
     :arg headers: any custom http headers to be add to requests
     """
     def __init__(self, host='localhost', port=9200, http_auth=None,
-            use_ssl=False, verify_certs=False, ca_certs=None, client_cert=None,
+            use_ssl=False, verify_certs=True, ca_certs=None, client_cert=None,
             client_key=None, ssl_version=None, ssl_assert_hostname=None,
             ssl_assert_fingerprint=None, maxsize=10, headers=None, **kwargs):
 
@@ -48,6 +56,7 @@ class Urllib3HttpConnection(Connection):
                 http_auth = ':'.join(http_auth)
             self.headers.update(urllib3.make_headers(basic_auth=http_auth))
 
+        ca_certs = CA_CERTS if ca_certs is None else ca_certs
         pool_class = urllib3.HTTPConnectionPool
         kw = {}
         if use_ssl:
@@ -59,14 +68,17 @@ class Urllib3HttpConnection(Connection):
             })
 
             if verify_certs:
+                if not ca_certs:
+                    raise ImproperlyConfigured("Root certificates are missing for certificate "
+                        "validation. Either pass them in using the ca_certs parameter or "
+                        "install certifi to use it automatically.")
+
                 kw.update({
                     'cert_reqs': 'CERT_REQUIRED',
                     'ca_certs': ca_certs,
                     'cert_file': client_cert,
                     'key_file': client_key,
                 })
-            elif ca_certs:
-                raise ImproperlyConfigured("You cannot pass CA certificates when verify SSL is off.")
             else:
                 warnings.warn(
                     'Connecting to %s using SSL with verify_certs=False is insecure.' % host)