Merge pull request certifi#79 from jdufresne/drop-weak

Remove old_where()

Author: sigmavirus24

MANIFEST.in

@@ -1 +1 @@
-include MANIFEST.in README.rst LICENSE certifi/cacert.pem certifi/weak.pem certifi/old_root.pem
+include MANIFEST.in README.rst LICENSE certifi/cacert.pem

Makefile

@@ -1,6 +1,5 @@
 update:
 	curl https://mkcert.org/generate/ | ./strip-non-ascii > certifi/cacert.pem
-	cat certifi/cacert.pem certifi/old_root.pem > certifi/weak.pem
 
 publish:
 	python setup.py sdist bdist_wheel

README.rst

@@ -35,13 +35,12 @@ bundle, replacing it with an equivalent strong (i.e. 2048-bit or greater key)
 certificate from the same CA. Because Mozilla removed these certificates from
 its bundle, ``certifi`` removed them as well.
 
-Unfortunately, old versions of OpenSSL (less than 1.0.2) sometimes fail to
-validate certificate chains that use the strong roots. For this reason, if you
-fail to validate a certificate using the ``certifi.where()`` mechanism, you can
-intentionally re-add the 1024-bit roots back into your bundle by calling
-``certifi.old_where()`` instead. This is not recommended in production: if at
-all possible you should upgrade to a newer OpenSSL. However, if you have no
-other option, this may work for you.
+In previous versions, ``certifi`` provided the ``certifi.old_where()`` function
+to intentionally re-add the 1024-bit roots back into your bundle. This was not
+recommended in production and therefore was removed. To assist in migrating old
+code, the function ``certifi.old_where()`` continues to exist as an alias of
+``certifi.where()``. Please update your code to use ``certifi.where()``
+instead. ``certifi.old_where()`` will be removed in 2018.
 
 .. _`Certifi`: http://certifi.io/en/latest/
 .. _`Requests`: http://docs.python-requests.org/en/latest/

certifi/core.py

@@ -26,12 +26,12 @@ def where():
 
 def old_where():
     warnings.warn(
-        "The weak security bundle is being deprecated. It will be removed in "
-        "2018.",
+        "The weak security bundle has been removed. certifi.old_where() is now an alias "
+        "of certifi.where(). Please update your code to use certifi.where() instead. "
+        "certifi.old_where() will be removed in 2018.",
         DeprecatedBundleWarning
     )
-    f = os.path.dirname(__file__)
-    return os.path.join(f, 'weak.pem')
+    return where()
 
 if __name__ == '__main__':
     print(where())