Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please consider removal of custom ca-cert included within codebase. #972

Open
danmarsden opened this issue Jul 14, 2020 · 2 comments
Open

Comments

@danmarsden
Copy link

It's generally considered bad practice to include your own version of the ca-cert bundle. Can you please look at removing this from your codebase? I can see how it might be "convenient" but it means that when performing a security review, we need to check to make sure your version of the ca-certs haven't been compromised.

@remi-stripe
Copy link
Contributor

@danmarsden Thanks for the report! We'll look into this and see if it's something we could deprecate in the future!

@Sheaffy
Copy link

Sheaffy commented Jun 28, 2024

I can agree with this.

Or at the very least, give us a option to use the systems certs via a function call similar to setCABundlePath.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants