@@ -83,36 +83,9 @@ See [`examples/google.rs`](examples/google.rs).
8383
8484(Background : [webpki - roots ](https : // crates.io/crates/webpki-roots) is a crate that compiles-in Mozilla's set of root certificates.)
8585
86- This crate is preferable in many ways to * webpki - roots * .
87- To sum up the pros and cons :
88-
89- Pros :
90-
91- - * * This crate respects local configuration of root certificates ** : both
92- removal of roots that the user finds untrustworthy , and addition of locally - trusted roots .
93- _The latter case is exceedingly important if your application is required to work in
94- enterprise environments with " transparent" TLS - terminating middleboxes . _
95- - * * This crate instantaneously reflects underlying system configuration ** . _Since webpki - roots
96- compiles in root certificates , getting an update to these requires taking regular updates
97- to this crate , plus recompilation and redeployment of the application . This is a long - winded
98- process that may become a liability in the event of a severe misissuance . _
99- - * * This crate is compatible with developer aids ** such as [mkcert ](https : // github.com/FiloSottile/mkcert).
100-
101- Cons :
102-
103- - * * Use of the OS certificate store is not the same as relying on OS trust verification **
104- because platform verifiers might impose additional criteria before deciding whether to trust
105- a root ostensibly included in the OS certificate store (for example , an expiration date ).
106- - * * The OS certificate store is occasionally " attacked" by [malware ](https : // en.wikipedia.org/wiki/Superfish)**
107- or just [bad software ](https : // sennheiser.zendesk.com/hc/en-us/articles/360011888254).
108- - * * The OS update system may , in fact , be quite poor at keeping the root certificates up - to - date **
109- if it is disabled or out - of - support .
110- - * * The quality of the `ca - certificates ` package on debian - based Linux distributions is poor ** .
111- At the time of writing , this ships many certificates not included in the Mozilla
112- set , either because they [failed an audit and were withdrawn ](https : // bugzilla.mozilla.org/show_bug.cgi?id=1448506) or
113- [were removed for mississuance ](https : // bugzilla.mozilla.org/show_bug.cgi?id=1552374).
114- - * * You may prefer to insulate yourself against local configuration ** for support or
115- (perhaps inadvisable ) security reasons .
86+ Please see `rustls - platform - verifier `'s documentation on [deployment considerations ](https : // github.com/rustls/rustls-platform-verifier?tab=readme-ov-file#deployment-considerations) for more info.
87+
88+ Additionally in most cases , the platform verifier is a better option then this crate if you are already considering `rustls - native - certs `.
11689
11790# License
11891
0 commit comments