3 ms·

> Python channel in Teams for coding support. So many questions were about SSL issues I learned the other day that Python doesn't support AIA chasing natively.

by ethbr1 2y ago

> Python channel in Teams for coding support. So many questions were about SSL issues I learned the other day that Python doesn't support AIA chasing natively. https://bugs.python.org/issue18617 https://bugs.python.org/issue18617 (Certs configured that way are technically incomplete, but because other browsers etc. handle it, it's now a "python breaks for certificates that work for other pieces of software" situation)

anttihaapala 2y ago
The issue was migrated to github so more up-to-date discussion is in https://github.com/python/cpython/issues/62817 https://github.com/python/cpython/issues/62817
- consp 2y ago
  This discussion is just "do it because some browsers do it" without any reasoning why (or why not) you should do it. Firefox approach is i guess the best compromise between user annoyance and developer annoyance but it's still a compromise against proper TLS.
richm44 2y ago
Downloading things from the AIA fields would mean triggering HTTP/HTTPS requests to an untrusted URL from a certificate you haven't verified - not a good idea. What firefox does is cache intermediates that it has seen elsewhere, the windows TLS stack can fetch additional certs from windows update on-demand (and actually starts with only a small bundle of trusted roots). There is no good solution for incomplete chains other than getting the sites fixed (or using a provider like cloudflare that solves it for them).
zerocrates 2y ago
I don't think I've seen anything but a browser ever do this, fixing an incomplete chain. curl, wget, several different programming languages, everything just fails to verify. I can understand why it wouldn't be supported, but you also see why users and developers experience this as just "SSL/TLS just gives you these weird errors sometimes" and pass around solutions to turn off verification.

by ethbr1 2y ago

anttihaapala 2y ago

The issue was migrated to github so more up-to-date discussion is in https://github.com/python/cpython/issues/62817 https://github.com/python/cpython/issues/62817

consp 2y ago
This discussion is just "do it because some browsers do it" without any reasoning why (or why not) you should do it. Firefox approach is i guess the best compromise between user annoyance and developer annoyance but it's still a compromise against proper TLS.

richm44 2y ago

Downloading things from the AIA fields would mean triggering HTTP/HTTPS requests to an untrusted URL from a certificate you haven't verified - not a good idea. What firefox does is cache intermediates that it has seen elsewhere, the windows TLS stack can fetch additional certs from windows update on-demand (and actually starts with only a small bundle of trusted roots). There is no good solution for incomplete chains other than getting the sites fixed (or using a provider like cloudflare that solves it for them).

zerocrates 2y ago

I don't think I've seen anything but a browser ever do this, fixing an incomplete chain. curl, wget, several different programming languages, everything just fails to verify. I can understand why it wouldn't be supported, but you also see why users and developers experience this as just "SSL/TLS just gives you these weird errors sometimes" and pass around solutions to turn off verification.