Skip to content

Commit efbc435

Browse files
committed
Remove deployment documentation and point to rustls-platform-verifier's instead
1 parent 9f793a1 commit efbc435

File tree

1 file changed

+3
-30
lines changed

1 file changed

+3
-30
lines changed

README.md

Lines changed: 3 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -83,36 +83,9 @@ See [`examples/google.rs`](examples/google.rs).
8383

8484
(Background: [webpki-roots](https://crates.io/crates/webpki-roots) is a crate that compiles-in Mozilla's set of root certificates.)
8585

86-
This crate is preferable in many ways to *webpki-roots*.
87-
To sum up the pros and cons:
88-
89-
Pros:
90-
91-
- **This crate respects local configuration of root certificates**: both
92-
removal of roots that the user finds untrustworthy, and addition of locally-trusted roots.
93-
_The latter case is exceedingly important if your application is required to work in
94-
enterprise environments with "transparent" TLS-terminating middleboxes._
95-
- **This crate instantaneously reflects underlying system configuration**. _Since webpki-roots
96-
compiles in root certificates, getting an update to these requires taking regular updates
97-
to this crate, plus recompilation and redeployment of the application. This is a long-winded
98-
process that may become a liability in the event of a severe misissuance._
99-
- **This crate is compatible with developer aids** such as [mkcert](https://github.com/FiloSottile/mkcert).
100-
101-
Cons:
102-
103-
- **Use of the OS certificate store is not the same as relying on OS trust verification**
104-
because platform verifiers might impose additional criteria before deciding whether to trust
105-
a root ostensibly included in the OS certificate store (for example, an expiration date).
106-
- **The OS certificate store is occasionally "attacked" by [malware](https://en.wikipedia.org/wiki/Superfish)**
107-
or just [bad software](https://sennheiser.zendesk.com/hc/en-us/articles/360011888254).
108-
- **The OS update system may, in fact, be quite poor at keeping the root certificates up-to-date**
109-
if it is disabled or out-of-support.
110-
- **The quality of the `ca-certificates` package on debian-based Linux distributions is poor**.
111-
At the time of writing, this ships many certificates not included in the Mozilla
112-
set, either because they [failed an audit and were withdrawn](https://bugzilla.mozilla.org/show_bug.cgi?id=1448506) or
113-
[were removed for mississuance](https://bugzilla.mozilla.org/show_bug.cgi?id=1552374).
114-
- **You may prefer to insulate yourself against local configuration** for support or
115-
(perhaps inadvisable) security reasons.
86+
Please see `rustls-platform-verifier`'s documentation on [deployment considerations](https://github.com/rustls/rustls-platform-verifier?tab=readme-ov-file#deployment-considerations) for more info.
87+
88+
Additionally in most cases, the platform verifier is a better option then this crate if you are already considering `rustls-native-certs`.
11689

11790
# License
11891

0 commit comments

Comments
 (0)