<story><title>Do you check HTTPS certificates in your API clients?  </title><url>http://unfoldthat.com/2012/07/30/does-https-to-api-make-any-sense.html</url></story><parent_chain></parent_chain><comment><author>tav</author><text>When you validate server certificates from HTTPS clients, please be sure to use the right set of root certs. Mozilla maintain a decent list of these [1], but it&apos;s not in the PEM format that most HTTPS client libraries expect, e.g. Python&apos;s ssl.wrap_socket(sock, ca_certs=&quot;certs.pem&quot;).&lt;p&gt;Mozilla&apos;s list also includes &lt;i&gt;distrusted&lt;/i&gt; certificates, so you need to be careful to leave them out when generating the PEM-encoded format. In fact, I&apos;d strongly recommend using Adam Langley&apos;s excellent extract-nss-root-certs tool [2] which takes care of the subtle details for you.&lt;p&gt;And, if you are willing to trust me, you can download my pre-generated PEM-encoded cacerts file from a month or so ago [3].&lt;p&gt;[1] &lt;a href=&quot;https://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1&quot; rel=&quot;nofollow&quot;&gt;https://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https://github.com/agl/extract-nss-root-certs&quot; rel=&quot;nofollow&quot;&gt;https://github.com/agl/extract-nss-root-certs&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;https://github.com/downloads/tav/ampify/distfile.cacerts-2012.06.28.tar.bz2&quot; rel=&quot;nofollow&quot;&gt;https://github.com/downloads/tav/ampify/distfile.cacerts-201...&lt;/a&gt;</text></comment>
<story><title>Do you check HTTPS certificates in your API clients?  </title><url>http://unfoldthat.com/2012/07/30/does-https-to-api-make-any-sense.html</url></story><parent_chain></parent_chain><comment><author>delinka</author><text>In this age of high-level languages, why do I still have to worry about this? I don&apos;t mean &apos;security&apos; I mean &apos;managing certificates.&apos; My local framework/API should complain if I don&apos;t have a trusted root and should then make it dead simple to provide that root.</text></comment>