Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

trust_list_path on Linux #33

Open
cunyx opened this issue Jul 31, 2019 · 0 comments
Open

trust_list_path on Linux #33

cunyx opened this issue Jul 31, 2019 · 0 comments

Comments

@cunyx
Copy link

cunyx commented Jul 31, 2019

As I read

if sys.platform in set(['win32', 'darwin']):

to
result = libssl.SSL_CTX_set_default_verify_paths(ssl_ctx)

a provided "trust_list_path" only gets applied on windows and mac, while on
other platforms trusted certificates are (only) loaded from the system default
via SSL_CTX_set_default_verify_paths(ssl_ctx) .

Later on, "extra_trust_roots" can be added, but this won't
override/replace/forget already loaded certificates from the system default.

According to
https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_default_verify_paths.html
this result might be influenced by setting environment variables.

To be able to ignore/tighten the systems trust settings without fiddling with
the environment, I tried to use the "trust_list_path" feature
for openssl on linux the same way it seems to be already possible
on windows and mac, with patch @

https://build.opensuse.org/package/view_file/home:cunix:pythondevel/python-oscrypto/allow_setting_path_to_trusted_certificates.patch

Is my described understanding correct?

If yes, is there a reason why "trust_list_path" should have an effect on some
platforms, but not on others?

If the second answer is "no",
might upstream be interested in taking this patch or something similar?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants