{"action":"closed","issue":{"url":"https://api.github.com/repos/certifi/python-certifi/issues/23","labels_url":"https://api.github.com/repos/certifi/python-certifi/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/certifi/python-certifi/issues/23/comments","events_url":"https://api.github.com/repos/certifi/python-certifi/issues/23/events","html_url":"https://github.com/certifi/python-certifi/issues/23","id":91930462,"number":23,"title":"Trusted certs pulled over insecure channel","user":{"login":"Prandium","id":1087705,"avatar_url":"https://avatars.githubusercontent.com/u/1087705?v=3","gravatar_id":"","url":"https://api.github.com/users/Prandium","html_url":"https://github.com/Prandium","followers_url":"https://api.github.com/users/Prandium/followers","following_url":"https://api.github.com/users/Prandium/following{/other_user}","gists_url":"https://api.github.com/users/Prandium/gists{/gist_id}","starred_url":"https://api.github.com/users/Prandium/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Prandium/subscriptions","organizations_url":"https://api.github.com/users/Prandium/orgs","repos_url":"https://api.github.com/users/Prandium/repos","events_url":"https://api.github.com/users/Prandium/events{/privacy}","received_events_url":"https://api.github.com/users/Prandium/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-29T22:57:05Z","updated_at":"2015-06-30T07:20:23Z","closed_at":"2015-06-30T07:20:23Z","body":"Currently certifi is pulling the ca-bundle over a non-TLS protected channel (http), which means that anyone between the host and ci.kennethreitz.org can inject or completely modify the ca certificates bundle to inject their own trusted ca, allowing them to man-in-the-middle tls traffic between python clients and any site they connect to. \r\n\r\nTo address this, the ca bundle should be hosted on a site protected by TLS, and https://github.com/certifi/python-certifi/blob/master/tasks.py#L5 should be updated to reflect the new endpoint."}}