Stop recommending CACert.org in the SSL documentation

[alex]

BPO	21043
Nosy	@pitrou, @alex, @dstufft
Files	cacert.diff cacert.diff cacert.diff

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2014-03-24.23:29:29.789>
created_at = <Date 2014-03-23.23:50:30.731>
labels = ['type-feature', 'docs']
title = 'Stop recommending CACert.org in the SSL documentation'
updated_at = <Date 2014-03-24.23:49:56.489>
user = 'https://github.com/alex'

bugs.python.org fields:

activity = <Date 2014-03-24.23:49:56.489>
actor = 'python-dev'
assignee = 'docs@python'
closed = True
closed_date = <Date 2014-03-24.23:29:29.789>
closer = 'dstufft'
components = ['Documentation']
creation = <Date 2014-03-23.23:50:30.731>
creator = 'alex'
dependencies = []
files = ['34598', '34599', '34600']
hgrepos = []
issue_num = 21043
keywords = ['patch']
message_count = 11.0
messages = ['214656', '214657', '214658', '214659', '214660', '214661', '214698', '214700', '214762', '214764', '214768']
nosy_count = 5.0
nosy_names = ['pitrou', 'alex', 'docs@python', 'python-dev', 'dstufft']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = None
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue21043'
versions = ['Python 3.4', 'Python 3.5']

[alex]

CACert is not in the root trust store on *any* platform that I'm aware of, and has not passed any audits. See http://lwn.net/SubscriberLink/590879/ce23ed7bab68e489/ for more background.

In it's place I've added StartSSL, which is included in most (all?) root trust stores, and offers free certs.

[dstufft]

I completely agree, it seems less than good to recommend CACert.

[pitrou]

That whole paragraph in the documentation is weird. Usually, you don't download select root certificates from various CAs, you just elect to trust a predetermined set of root certs (the system ones, usually).

I would suggest rewording it and dropping the various download URLs.

(and if the suggestion to provide the full chain is obsolete for SSLv3 and TLSv1, then similarly it may be dropped entirely - we needn't support SSLv2 specificities in the docs)

[dstufft]

It's quite old (that paragraph) likely it was written that way because back then Python didn't have a way to load certificates.

[alex]

I've attempted to modernize the paragraph.

[alex]

Removed 2.7 since there's no API for getting the platform certs.

[dstufft]

The latest patch looks good to me.

[pitrou]

Looks good to me too.

[python-dev]

New changeset 6f776c91da08 by Donald Stufft in branch '3.4':
Issue bpo-21043: Remove the recommendation for specific CA organizations
http://hg.python.org/cpython/rev/6f776c91da08

[python-dev]

New changeset 0485552b487e by Donald Stufft in branch 'default':
Merge in 3.4 to bring forward the Issue bpo-21043 changes.
http://hg.python.org/cpython/rev/0485552b487e