Groups > comp.lang.python.announce > #2372

Announcement: TLSv1.2 will become mandatory in the future for Python.org Sites

Path	csiph.com!fu-berlin.de!uni-berlin.de!not-for-mail
From	Donald Stufft <donald@python.org>
Newsgroups	comp.lang.python.announce
Subject	Announcement: TLSv1.2 will become mandatory in the future for Python.org Sites
Date	Tue, 10 Jan 2017 08:27:21 -0500
Lines	57
Approved	python-announce-list@python.org
Message-ID	<mailman.451.1484055821.2395.python-announce-list@python.org> (permalink)
References	<1B1B29CD-AA4E-47C0-89A8-2748D5A14FC3@python.org>
Mime-Version	1.0 (Mac OS X Mail 10.2 \(3259\))
Content-Type	text/plain; charset=us-ascii
Content-Transfer-Encoding	quoted-printable
X-Trace	news.uni-berlin.de paIHhyYxcWeAoHm3q8XPBwNOPRoaouC+42I1xGg0VuGw==
Return-Path	<donald@python.org>
X-Original-To	python-announce-list@python.org
Delivered-To	python-announce-list@mail.python.org
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/simple; d=python.org; s=200901; t=1484054842; bh=sJkdAkpWv4HSIJ+hKMlRsNETYBx1Tf8HsncxfIlas0s=; h=From:Subject:Date:To:From; b=l317xU6CRssAb6a3/p6ukiGoIdzuWXrFZPqJJs9p7PrnCeQ1/ptUNK1fVB9LGjQE0 WgDIX/jA2KyV9m4aP20jidZBvuQX/jBZ5eretk6ctt7RwNBFq7RgHgP6DEnjHmU70y 8q6BWNE0beDIht+weq+QXhp1OClvsl3qaWg4khCc=
X-Mailer	Apple Mail (2.3259)
X-Mailman-Approved-At	Tue, 10 Jan 2017 08:43:40 -0500
X-BeenThere	python-announce-list@python.org
X-Mailman-Version	2.1.23
Precedence	list
List-Id	Announcement-only list for the Python programming language <python-announce-list.python.org>
List-Unsubscribe	<https://mail.python.org/mailman/options/python-announce-list>, <mailto:python-announce-list-request@python.org?subject=unsubscribe>
List-Archive	<http://mail.python.org/pipermail/python-announce-list/>
List-Post	<mailto:python-announce-list@python.org>
List-Help	<mailto:python-announce-list-request@python.org?subject=help>
List-Subscribe	<https://mail.python.org/mailman/listinfo/python-announce-list>, <mailto:python-announce-list-request@python.org?subject=subscribe>
X-Mailman-Original-Message-ID	<1B1B29CD-AA4E-47C0-89A8-2748D5A14FC3@python.org>
Xref	csiph.com comp.lang.python.announce:2372

Show key headers only | View raw

Fastly has announced plans to disable TLSv1.0 and TLSv1.1 on their CDN endpoints
which will include PyPI (as well as other Python properties). You can see their
timeline at https://www.fastly.com/blog/phase-two-our-tls-10-and-11-deprecation-plan.

There are two hard cut off dates to remember:

* April 30, 2017, which is when any Python.org site you see that does *not*
  have an EV certificate that is hosted by Fastly will no longer support
  TLSv1.0 and TLSv1.1 (testpypi.python.org, test.pypi.org,
  files.pythonhosted.org, etc).

* June 30, 2018, which is when any Python.org site you see that has an EV
  certificate that is hosted by Fastly will no longer support TSLv1.0 and
  TLSv1.1 (pypi.python.org, pypi.org, etc).

I am going to see about possibly organizing some scheduled "brown outs" of
TLSv1.0 and TLSv1.1 prior to the cut off dates to try and help folks find places
that will need updates. Any scheduled brownouts will be posted to
status.python.org prior to happening.

Looking at the download numbers, the absolute largest driver of TLSv1.0 and
TLSv1.1 traffic to PyPI are old versions of pip or other clients where I cannot
tell the OS that they are being run on. Past that, macOS is going to be the
largest casualty since their system Python does not support TLSv1.2 yet in any
version of their OS.

If you have a Python and you want to check to see if it supports TLSv1.2 or not,
the easiest way to do that is by running:

    python2 -c "import urllib2,json; print(json.loads(urllib2.urlopen('https://www.howsmyssl.com/a/check').read())['tls_version'])"

    OR

    python3 -c "import urllib.request,json; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read())['tls_version'])"

If you get something other than TLS 1.2, then I suggest making plans to deal
with the inevitable breakage which may start occurring on or before April 30,
2017.

Back to comp.lang.python.announce | Previous | Next | Find similar | Unroll thread

Thread

Announcement: TLSv1.2 will become mandatory in the future for Python.org Sites Donald Stufft <donald@python.org> - 2017-01-10 08:27 -0500

csiph-web