Py2exe includes a broken version of certifi in library.zip if certifi is installed on system
Created originally on Bitbucket by gstefanik (Gábor Stefanik)
The "certifi" package is designed to provide an up-to-date list of trusted certificate authorities for SSL/TLS. Unfortunately, the way it's written makes it fundamentally incompatible with py2exe or any other setup that uses a library.zip file.
Since using certifi on Windows is probably the wrong thing anyway (it overrides the system certificate store, including any custom certificates provisioned through Active Directory or group policies), it should be blacklisted somehow so it doesn't get included into the library.zip file. Perhaps shipping certifi's cacert.pem in hgrc.d makes sense (disabled by default to play nice with AD/group policy), but the python code for certifi itself should not be shipped.
This is currently worked around in Mercurial's code, by falling back to the system CA store if certifi is available, but certifi.where() returns a nonexistent or unreachable file, so it's no longer a blocker. Still, it would be nice to see it fixed.