4 ms·

In this age of high-level languages, why do I still have to worry about this? I don't mean 'security' I mean 'managing certificates.' My local framework/API sho

by delinka 14y ago

In this age of high-level languages, why do I still have to worry about this? I don't mean 'security' I mean 'managing certificates.' My local framework/API should complain if I don't have a trusted root and should then make it dead simple to provide that root.

va1en0k 14y ago
Exactly. Security is something that should just work - arguably, the first thing with such requirement. Even though it simply can't just work in many cases, it should be as close to just-working as it can.
TeHCrAzY 14y ago
That's exactly how it works in C# (.NET in general), and I would take a fairly large bet that's exactly the same in Java. It seems like a regression (when thinking on terms of lower level --> higher level language movement).
rfugger 14y ago
Python does have some certificate-checking machinery: http://docs.python.org/library/ssl.html#functions-constants-and-exceptions http://docs.python.org/library/ssl.html#functions-constants-... http://docs.python.org/library/ssl.html#ssl-certificates http://docs.python.org/library/ssl.html#ssl-certificates However, this isn't exposed in the higher-level httplib.HTTPSConnection class for some reason. I'd bet it's not too hard to write your own subclass to handle it though.
- natrius 14y ago
  If you're using Python for HTTP requests, you should be using Requests, which checks SSL certificates by default (as far as I can tell). http://docs.python-requests.org/en/latest/ http://docs.python-requests.org/en/latest/
  - voltagex_ 14y ago
    Yeah, I posted this below. It's mentioned in the advanced section. Why checking your SSL certs is an advanced topic I don't know.
- __alexs 14y ago
  This doesn't do any CRL or OCSP checks at all so you are still vulnerable to attacks using revoked certificates.
tptacek 14y ago
Because during most of the development cycle when these libraries are being used, the certificates aren't validating (they're dev/test/UAT systems) --- and so during actual development, certificate verification seems like just another annoying obstacle to clear as quickly as possible.
- obtu 14y ago
  It's easy enough to generate a snakeoil cert and use its public part as your cert bundle. On Debian/Ubuntu, just install the ssl-cert package, and point to /etc/ssl/certs/ssl-cert-snakeoil.pem as your certificate bundle; the private key is at /etc/ssl/private/ssl-cert-snakeoil.key . Or just serve your app/API/etc from different urls, plain HTTP for development and HTTPS for preprod and production.
obtu 14y ago
In Python, a sufficiently recent httplib2 will require valid certificates by default; same with the requests library. Both let you use your own cert bundle, as a quick-and-dirty way to do certificate pinning. That's reason enough to discourage the use of Python's standard library for http requests (another reason is that it's quite low-level).

by delinka 14y ago

va1en0k 14y ago

Exactly. Security is something that should just work - arguably, the first thing with such requirement. Even though it simply can't just work in many cases, it should be as close to just-working as it can.

TeHCrAzY 14y ago

That's exactly how it works in C# (.NET in general), and I would take a fairly large bet that's exactly the same in Java. It seems like a regression (when thinking on terms of lower level --> higher level language movement).

rfugger 14y ago

Python does have some certificate-checking machinery: http://docs.python.org/library/ssl.html#functions-constants-and-exceptions http://docs.python.org/library/ssl.html#functions-constants-... http://docs.python.org/library/ssl.html#ssl-certificates http://docs.python.org/library/ssl.html#ssl-certificates However, this isn't exposed in the higher-level httplib.HTTPSConnection class for some reason. I'd bet it's not too hard to write your own subclass to handle it though.

natrius 14y ago
If you're using Python for HTTP requests, you should be using Requests, which checks SSL certificates by default (as far as I can tell). http://docs.python-requests.org/en/latest/ http://docs.python-requests.org/en/latest/
- voltagex_ 14y ago
  Yeah, I posted this below. It's mentioned in the advanced section. Why checking your SSL certs is an advanced topic I don't know.
__alexs 14y ago
This doesn't do any CRL or OCSP checks at all so you are still vulnerable to attacks using revoked certificates.

tptacek 14y ago

Because during most of the development cycle when these libraries are being used, the certificates aren't validating (they're dev/test/UAT systems) --- and so during actual development, certificate verification seems like just another annoying obstacle to clear as quickly as possible.

obtu 14y ago
It's easy enough to generate a snakeoil cert and use its public part as your cert bundle. On Debian/Ubuntu, just install the ssl-cert package, and point to /etc/ssl/certs/ssl-cert-snakeoil.pem as your certificate bundle; the private key is at /etc/ssl/private/ssl-cert-snakeoil.key . Or just serve your app/API/etc from different urls, plain HTTP for development and HTTPS for preprod and production.

obtu 14y ago

In Python, a sufficiently recent httplib2 will require valid certificates by default; same with the requests library. Both let you use your own cert bundle, as a quick-and-dirty way to do certificate pinning. That's reason enough to discourage the use of Python's standard library for http requests (another reason is that it's quite low-level).