Hacker News new | ask | show | jobs
by NicolaiS 20 days ago
> "make your clients trust the CA"

There's no single trust store: the OS has one, Firefox, Java (cacerts), Python (certifi), Node, Go containers, all your Docker images, ...

Failure? People just toggle TLS verification off.

Easy to do in a one-man shop, but almost impossible in any big company. Try grepping for verify=False / -k / InsecureSkipVerify in any fortune 500 and you'll find plenty
1 comments
denkmoon 20 days ago
Yes, it feels like I echo the same sentiment at work every few weeks. No, we can’t tick the PR with verify=false. Yes, you have to configure the trust store. Yes, it’ll take maybe an hour to work this out. Go do so please.

The only reason is laziness.

link