diff --git a/mercurial/sslutil.py b/mercurial/sslutil.py
index 4e72995f6c9cb6d873129f6ae63374433409e729_bWVyY3VyaWFsL3NzbHV0aWwucHk=..918dce4b8c26efebc40853d39a121e9174f3f3d8_bWVyY3VyaWFsL3NzbHV0aWwucHk= 100644
--- a/mercurial/sslutil.py
+++ b/mercurial/sslutil.py
@@ -197,7 +197,7 @@
                                       cafile)
             else:
                 # CAs not defined in config. Try to find system bundles.
-                cafile = _defaultcacerts()
+                cafile = _defaultcacerts(ui)
                 if cafile:
                     ui.debug('using %s for CA file\n' % cafile)
 
@@ -430,7 +430,7 @@
     return (exe.startswith('/usr/bin/python') or
             exe.startswith('/system/library/frameworks/python.framework/'))
 
-def _defaultcacerts():
+def _defaultcacerts(ui):
     """return path to default CA certificates or None."""
     if _plainapplepython():
         dummycert = os.path.join(os.path.dirname(__file__), 'dummycert.pem')
diff --git a/tests/hghave.py b/tests/hghave.py
index 4e72995f6c9cb6d873129f6ae63374433409e729_dGVzdHMvaGdoYXZlLnB5..918dce4b8c26efebc40853d39a121e9174f3f3d8_dGVzdHMvaGdoYXZlLnB5 100644
--- a/tests/hghave.py
+++ b/tests/hghave.py
@@ -415,9 +415,10 @@
 
 @check("defaultcacerts", "can verify SSL certs by system's CA certs store")
 def has_defaultcacerts():
-    from mercurial import sslutil
-    return sslutil._defaultcacerts() or sslutil._canloaddefaultcerts
+    from mercurial import sslutil, ui as uimod
+    ui = uimod.ui()
+    return sslutil._defaultcacerts(ui) or sslutil._canloaddefaultcerts
 
 @check("defaultcacertsloaded", "detected presence of loaded system CA certs")
 def has_defaultcacertsloaded():
     import ssl
@@ -420,11 +421,11 @@
 
 @check("defaultcacertsloaded", "detected presence of loaded system CA certs")
 def has_defaultcacertsloaded():
     import ssl
-    from mercurial import sslutil
+    from mercurial import sslutil, ui as uimod
 
     if not has_defaultcacerts():
         return False
     if not has_sslcontext():
         return False
 
@@ -425,10 +426,11 @@
 
     if not has_defaultcacerts():
         return False
     if not has_sslcontext():
         return False
 
-    cafile = sslutil._defaultcacerts()
+    ui = uimod.ui()
+    cafile = sslutil._defaultcacerts(ui)
     ctx = ssl.create_default_context()
     if cafile:
         ctx.load_verify_locations(cafile=cafile)