classification
Title: Stop recommending CACert.org in the SSL documentation
Type: enhancement Stage:
Components: Documentation Versions: Python 3.5, Python 3.4
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: docs@python Nosy List: alex, docs@python, dstufft, pitrou, python-dev
Priority: normal Keywords: patch

Created on 2014-03-23 23:50 by alex, last changed 2014-03-24 23:49 by python-dev. This issue is now closed.

Files
File name Uploaded Description Edit
cacert.diff alex, 2014-03-23 23:50 review
cacert.diff alex, 2014-03-24 00:10 review
cacert.diff alex, 2014-03-24 00:11 review
Messages (11)
msg214656 - (view) Author: Alex Gaynor (alex) * (Python committer) Date: 2014-03-23 23:50
CACert is not in the root trust store on *any* platform that I'm aware of, and has not passed any audits. See http://lwn.net/SubscriberLink/590879/ce23ed7bab68e489/ for more background.

In it's place I've added StartSSL, which is included in most (all?) root trust stores, and offers free certs.
msg214657 - (view) Author: Donald Stufft (dstufft) * (Python committer) Date: 2014-03-23 23:51
I completely agree, it seems less than good to recommend CACert.
msg214658 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2014-03-24 00:01
That whole paragraph in the documentation is weird. Usually, you don't download select root certificates from various CAs, you just elect to trust a predetermined set of root certs (the system ones, usually).

I would suggest rewording it and dropping the various download URLs.

(and if the suggestion to provide the full chain is obsolete for SSLv3 and TLSv1, then similarly it may be dropped entirely - we needn't support SSLv2 specificities in the docs)
msg214659 - (view) Author: Donald Stufft (dstufft) * (Python committer) Date: 2014-03-24 00:02
It's quite old (that paragraph) likely it was written that way because back then Python didn't have a way to load certificates.
msg214660 - (view) Author: Alex Gaynor (alex) * (Python committer) Date: 2014-03-24 00:10
I've attempted to modernize the paragraph.
msg214661 - (view) Author: Alex Gaynor (alex) * (Python committer) Date: 2014-03-24 00:10
Removed 2.7 since there's no API for getting the platform certs.
msg214698 - (view) Author: Donald Stufft (dstufft) * (Python committer) Date: 2014-03-24 16:49
The latest patch looks good to me.
msg214700 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2014-03-24 17:01
Looks good to me too.
msg214762 - (view) Author: Roundup Robot (python-dev) Date: 2014-03-24 23:27
New changeset 6f776c91da08 by Donald Stufft in branch '3.4':
Issue #21043: Remove the recommendation for specific CA organizations
http://hg.python.org/cpython/rev/6f776c91da08
msg214764 - (view) Author: Roundup Robot (python-dev) Date: 2014-03-24 23:28
New changeset 0485552b487e by Donald Stufft in branch 'default':
Merge in 3.4 to bring forward the Issue #21043 changes.
http://hg.python.org/cpython/rev/0485552b487e
msg214768 - (view) Author: Roundup Robot (python-dev) Date: 2014-03-24 23:49
New changeset 7ef262eafecd by Donald Stufft in branch '2.7':
Issue #21043 - Remove CACert.org from the recommendations
http://hg.python.org/cpython/rev/7ef262eafecd
History
Date User Action Args
2014-03-24 23:49:56python-devsetmessages: + msg214768
2014-03-24 23:29:29dstufftsetstatus: open -> closed
resolution: fixed
2014-03-24 23:28:27python-devsetmessages: + msg214764
2014-03-24 23:27:08python-devsetnosy: + python-dev
messages: + msg214762
2014-03-24 17:01:43pitrousetmessages: + msg214700
2014-03-24 16:49:27dstufftsetmessages: + msg214698
2014-03-24 00:23:54BreamoreBoysettitle: Stop reccomending CACert.org in the SSL documentation -> Stop recommending CACert.org in the SSL documentation
2014-03-24 00:11:24alexsetfiles: + cacert.diff
2014-03-24 00:10:54alexsetmessages: + msg214661
versions: - Python 2.7
2014-03-24 00:10:32alexsetfiles: + cacert.diff

messages: + msg214660
2014-03-24 00:02:48dstufftsetmessages: + msg214659
2014-03-24 00:01:24pitrousetnosy: + pitrou
messages: + msg214658
2014-03-23 23:52:34alexsetversions: + Python 2.7, Python 3.4, Python 3.5
2014-03-23 23:51:17dstufftsetmessages: + msg214657
2014-03-23 23:50:30alexcreate