4 ms·

I'm sure it was even worse before, but I'm not entirely happy with the look of that. * I shouldn't have to care where the certificates are stored. Just load th

by im3w1l 3y ago

I'm sure it was even worse before, but I'm not entirely happy with the look of that. * I shouldn't have to care where the certificates are stored. Just load the os default ones without asking me. * I shouldn't have to know what a pem is, and I shouldn't have to open() one. * I don't want a PolicyBuilder. Just give me the normal policy. * I shouldn't have to construct some verifier object specific to a given dns. I don't want to verify a billion certificates for one domain, just one. * I shouldn't have to know what an untrusted intermediary is. Here's what I think it should look like verifier = Verifier() # constructs a verifier with sensible defaults, overrides are possible though verifier.verify(chain, "cryptography.io")

paragon_init 3y ago
> * I shouldn't have to care where the certificates are stored. Just load the os default ones without asking me. > * I shouldn't have to know what a pem is, and I shouldn't have to open() one. Agreed, but what you're requesting is separate from the work being discussed in this blog post, and both are actually compatible. For the PHP community, we made Certainty - https://github.com/paragonie/certainty https://github.com/paragonie/certainty You can just... <?php use ParagonIE\Certainty\RemoteFetch; // cURL boilerplate $ch = curl_init(); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // Fetch the latest CACert bundle, verify its authenticity, save it locally $fetcher = new RemoteFetch('/path/to/certainty/data'); $latestCACertBundle = $fetcher->getLatestBundle(); curl_setopt($ch, CURLOPT_CAINFO, $latestCACertBundle->getFilePath()); Writing a Python client should be relatively straightforward, should anyone want to. For Python specifically, there may be some value in storing the relevant PEM files into something like SigStore. That could be an easier proposal for the PyCA team to consider.

by im3w1l 3y ago

paragon_init 3y ago

> * I shouldn't have to care where the certificates are stored. Just load the os default ones without asking me. > * I shouldn't have to know what a pem is, and I shouldn't have to open() one. Agreed, but what you're requesting is separate from the work being discussed in this blog post, and both are actually compatible. For the PHP community, we made Certainty - https://github.com/paragonie/certainty https://github.com/paragonie/certainty You can just... <?php use ParagonIE\Certainty\RemoteFetch; // cURL boilerplate $ch = curl_init(); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // Fetch the latest CACert bundle, verify its authenticity, save it locally $fetcher = new RemoteFetch('/path/to/certainty/data'); $latestCACertBundle = $fetcher->getLatestBundle(); curl_setopt($ch, CURLOPT_CAINFO, $latestCACertBundle->getFilePath()); Writing a Python client should be relatively straightforward, should anyone want to. For Python specifically, there may be some value in storing the relevant PEM files into something like SigStore. That could be an easier proposal for the PyCA team to consider.