{"action":"created","issue":{"url":"https://api.github.com/repos/certifi/python-certifi/issues/19","labels_url":"https://api.github.com/repos/certifi/python-certifi/issues/19/labels{/name}","comments_url":"https://api.github.com/repos/certifi/python-certifi/issues/19/comments","events_url":"https://api.github.com/repos/certifi/python-certifi/issues/19/events","html_url":"https://github.com/certifi/python-certifi/issues/19","id":66533701,"number":19,"title":"Remove CNNIC?","user":{"login":"kevinburke","id":234019,"avatar_url":"https://avatars.githubusercontent.com/u/234019?v=3","gravatar_id":"","url":"https://api.github.com/users/kevinburke","html_url":"https://github.com/kevinburke","followers_url":"https://api.github.com/users/kevinburke/followers","following_url":"https://api.github.com/users/kevinburke/following{/other_user}","gists_url":"https://api.github.com/users/kevinburke/gists{/gist_id}","starred_url":"https://api.github.com/users/kevinburke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kevinburke/subscriptions","organizations_url":"https://api.github.com/users/kevinburke/orgs","repos_url":"https://api.github.com/users/kevinburke/repos","events_url":"https://api.github.com/users/kevinburke/events{/privacy}","received_events_url":"https://api.github.com/users/kevinburke/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-06T05:42:29Z","updated_at":"2015-04-06T11:10:02Z","closed_at":null,"body":"CNNIC issued an intermediate certificate to an organization that used it to issue valid certificates for many sites all over the Internet. In response, Mozilla and Chrome have both suspended accepting new CNNIC certificates: https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/\r\n\r\nThey are both accepting any certificates issued before April 1, 2015, but not any issued since then, until CNNIC applies and is re-admitted as a SSL vendor.\r\n\r\nI was wondering if certifi had the ability to distinguish certificates issued by an authority and if so, if certifi should un-certify new CNNIC certificates."},"comment":{"url":"https://api.github.com/repos/certifi/python-certifi/issues/comments/90018092","html_url":"https://github.com/certifi/python-certifi/issues/19#issuecomment-90018092","issue_url":"https://api.github.com/repos/certifi/python-certifi/issues/19","id":90018092,"user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"created_at":"2015-04-06T11:10:02Z","updated_at":"2015-04-06T11:10:02Z","body":"Sadly, this is trickier than it looks.\r\n\r\nOpenSSL does not provide us with the freedom to add these restrictions to its certificate validation steps. We can only have two states: do trust CNNIC, or don't trust CNNIC. I think we should move to \"don't trust\", but we can't just simply make that change.\r\n\r\nWe also have another problem with cross-signed root certificates, which I intend to think about at PyCon."}}