2 ms·

> "make your clients trust the CA" There's no single trust store: the OS has one, Firefox, Java (cacerts), Python (certifi), Node, Go containers, all your Dock

> "make your clients trust the CA" There's no single trust store: the OS has one, Firefox, Java (cacerts), Python (certifi), Node, Go containers, all your Docker images, ... Failure? People just toggle TLS verification off. Easy to do in a one-man shop, but almost impossible in any big company. Try grepping for verify=False / -k / InsecureSkipVerify in any fortune 500 and you'll find plenty

denkmoon 3mo ago
Yes, it feels like I echo the same sentiment at work every few weeks. No, we can’t tick the PR with verify=false. Yes, you have to configure the trust store. Yes, it’ll take maybe an hour to work this out. Go do so please. The only reason is laziness.