ssl cert verification needs better defaults for all supported platforms

[Vincent Ladeuil]

While the "/etc/ssl/certs/ca-certificates.crt" default value for the ssl.ca_certs config option is ok for Ubuntu/Debian/Gentoo, we want to add some platform specific values.

A quick google search gives:

freebsd: /usr/local/share/certs/ca-root-nss.crt

fedora/rh: /etc/pki/tls/certs/ca-bundle.crt

opensuse/sle: /etc/ssl/ca-bundle.pem

osx: the certificates are stored in the system key chain, not sure how to proceed there, either we find a way to access them directly or we should provide a script or a recipe to extract/update them.

windows: IIRC we already provide some bundle for pycurl that we can reuse

We probably want to fix this before 2.5.0 is out so marking high (critical seems too much).

[Vincent Ladeuil (vila)]

Adding bzr-windows-installer to keep track of which path is needed/used/tested.

[Vincent Ladeuil (vila)]

Adding bzr-mac-installer to keep track of which path is needed/used/tested.

[Martin Pool (mbp)]

There's a somewhat different, related, bug, which is that on osx and windows, there may not be a single file we need to read, but rather there's an api we need to call.

What we can do as a stop gap is to add an option that disables verification only when there are no trusted certificates.

[Vincent Ladeuil (vila)]

I've filed bug #932647 and bug #932648 for windows and osx so the long term solution can be tracked.

Bug #929179 takes care of disabling the sll verification for these platforms.