diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 8dad013..e407e30 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
@@ -45,7 +45,7 @@ jobs:
           password: ${{ secrets.pypi_password }}
 
       - name: Publish package to TestPyPI
-        uses: pypa/gh-action-pypi-publish@master
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
           user: __token__
           password: ${{ secrets.test_pypi_password }}
diff --git a/twitter/api.py b/twitter/api.py
index 6d8300e..8bcf4de 100644
--- a/twitter/api.py
+++ b/twitter/api.py
@@ -377,13 +377,17 @@ def __call__(self, params={}, **kwargs):
             return self._handle_response(req, uri, arg_data, _timeout)
 
     def _handle_response(self, req, uri, arg_data, _timeout=None):
-        kwargs = {'cafile': certifi.where()}
+        kwargs = {}
         if _timeout:
             kwargs['timeout'] = _timeout
         try:
             context = None
-            if not self.verify_context and _HAVE_SSL:
-                context = ssl._create_unverified_context()
+            if _HAVE_SSL:
+                if not self.verify_context:
+                    context = ssl._create_unverified_context()
+                else:
+                    context = ssl.create_default_context()
+                    context.load_verify_locations(cafile=certifi.where())
             kwargs['context'] = context
             handle = urllib_request.urlopen(req, **kwargs)
             if handle.headers['Content-Type'] in ['image/jpeg', 'image/png']:
diff --git a/twitter/stream.py b/twitter/stream.py
index b3d97a9..dd5a4c2 100644
--- a/twitter/stream.py
+++ b/twitter/stream.py
@@ -219,9 +219,13 @@ def __iter__(self):
 def handle_stream_response(req, uri, arg_data, block, timeout, heartbeat_timeout, verify_context=True):
     try:
         context = None
-        if not verify_context and _HAVE_SSL:
-            context = ssl._create_unverified_context()
-        handle = urllib_request.urlopen(req, context=context, cafile=certifi.where())
+        if _HAVE_SSL:
+            if not verify_context:
+                context = ssl._create_unverified_context()
+            else:
+                context = ssl.create_default_context()
+                context.load_verify_locations(cafile=certifi.where())
+        handle = urllib_request.urlopen(req, context=context)
     except urllib_error.HTTPError as e:
         raise TwitterHTTPError(e, uri, 'json', arg_data)
     return iter(TwitterJSONIter(handle, uri, arg_data, block, timeout, heartbeat_timeout))