Path: csiph.com!fu-berlin.de!uni-berlin.de!not-for-mail
From: Donald Stufft <donald@python.org>
Newsgroups: comp.lang.python.announce
Subject: Announcement: TLSv1.2 will become mandatory in the future for Python.org Sites
Date: Tue, 10 Jan 2017 08:27:21 -0500
Lines: 57
Approved: python-announce-list@python.org
Message-ID: <mailman.451.1484055821.2395.python-announce-list@python.org>
References: <1B1B29CD-AA4E-47C0-89A8-2748D5A14FC3@python.org>
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Precedence: list
Xref: csiph.com comp.lang.python.announce:2372

Fastly has announced plans to disable TLSv1.0 and TLSv1.1 on their CDN =
endpoints
which will include PyPI (as well as other Python properties). You can =
see their
timeline at =
https://www.fastly.com/blog/phase-two-our-tls-10-and-11-deprecation-plan.

There are two hard cut off dates to remember:

* April 30, 2017, which is when any Python.org site you see that does =
*not*
  have an EV certificate that is hosted by Fastly will no longer support
  TLSv1.0 and TLSv1.1 (testpypi.python.org, test.pypi.org,
  files.pythonhosted.org, etc).

* June 30, 2018, which is when any Python.org site you see that has an =
EV
  certificate that is hosted by Fastly will no longer support TSLv1.0 =
and
  TLSv1.1 (pypi.python.org, pypi.org, etc).

I am going to see about possibly organizing some scheduled "brown outs" =
of
TLSv1.0 and TLSv1.1 prior to the cut off dates to try and help folks =
find places
that will need updates. Any scheduled brownouts will be posted to
status.python.org prior to happening.

Looking at the download numbers, the absolute largest driver of TLSv1.0 =
and
TLSv1.1 traffic to PyPI are old versions of pip or other clients where I =
cannot
tell the OS that they are being run on. Past that, macOS is going to be =
the
largest casualty since their system Python does not support TLSv1.2 yet =
in any
version of their OS.

If you have a Python and you want to check to see if it supports TLSv1.2 =
or not,
the easiest way to do that is by running:

    python2 -c "import urllib2,json; =
print(json.loads(urllib2.urlopen('https://www.howsmyssl.com/a/check').read=
())['tls_version'])"

    OR

    python3 -c "import urllib.request,json; =
print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check=
').read())['tls_version'])"

If you get something other than TLS 1.2, then I suggest making plans to =
deal
with the inevitable breakage which may start occurring on or before =
April 30,
2017.=