pin only the root certs. enable tests

Author: mohit

clever/__init__.py

@@ -307,15 +307,11 @@ def requests_request(self, meth, abs_url, headers, params):
         # Use a CA_BUNDLE containing the following chain:
         # - TrustedRoot
         # - DigiCert High Assurance EV - 1
-        # - Clever.com EV
         #
         # This ensures that only this certificate chain is used to verify SSL certs.
         # Certs dervived from other ca certs will be treated as invalid.
         # eg. https://api.twitter.com and https://api.stripe.com FAIL
         #     https://api.clever.com and https://api.github.com PASS
-        #
-        # TODO: This gets us close to CERT PINNING but we need to pin the entire
-        # chain not just the CA
         result = requests.request(meth, abs_url,
                                   headers=headers, data=data, timeout=80,
                                   verify=CLEVER_CERTS)

clever/data/clever.com_ca_bundle.crt

@@ -1,47 +1,4 @@
 -----BEGIN CERTIFICATE-----
-MIIHfzCCBmegAwIBAgIQCPhB0GT5rc6+MyBE9GU0MjANBgkqhkiG9w0BAQUFADBp
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSgwJgYDVQQDEx9EaWdpQ2VydCBIaWdoIEFzc3VyYW5j
-ZSBFViBDQS0xMB4XDTEzMTIzMTAwMDAwMFoXDTE1MDMwNTEyMDAwMFowgf0xHTAb
-BgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYBBAGCNzwCAQMTAlVT
-MRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYDVQQFEwc1MTUwNjgwMSUw
-IwYDVQQJExwxNDAgMm5kIFN0cmVldC4gRm91cnRoIEZsb29yMQ4wDAYDVQQREwU5
-NDEwNTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcT
-DVNhbiBGcmFuY2lzY28xFDASBgNVBAoTC0NsZXZlciBJbmMuMRMwEQYDVQQDEwpj
-bGV2ZXIuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1wbQSZoN
-79tQEIxIPUgktcLxtl/gJaXoHfkf40/5qQq6qELAM3jDfC6iv+h23MTV2k5pcJ0e
-4NIXNr5NZnlPtjDAws3xHuRNLwkjp+iE5ZIsVYz3Vm4KTiCOQ6UABLXIUfOyTOd8
-knH/hNyRKyrolwxR0LuqA6n7qM3YUjq0K+glX1QGqtC6ByKm9W5HagA/HQ9knIm9
-FHLghjbnOdl7BTT+pLTYybyS6a3EUmVE1wwGYJkW8hli5YyAWBYK3UDR+8sIJPl9
-6aQF4n6p+m7UIB+CzwL5G3Juy3CatHlUAAuwyISMstTpNEhKG3AFIIvqlICVJBq9
-Nh4gJLeWP+Su0QIDAQABo4IDjDCCA4gwHwYDVR0jBBgwFoAUTFjLJfBBT1L0KMiB
-Q5umqKDmkuUwHQYDVR0OBBYEFN8EJ3FfAeuUYNNUHFCYPSFHN1OyMF0GA1UdEQRW
-MFSCCmNsZXZlci5jb22CDnd3dy5jbGV2ZXIuY29tghJhY2NvdW50LmNsZXZlci5j
-b22CEnN1cHBvcnQuY2xldmVyLmNvbYIOYXBpLmNsZXZlci5jb20wDgYDVR0PAQH/
-BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBjBgNVHR8EXDBa
-MCugKaAnhiVodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vZXZjYTEtZzMuY3JsMCug
-KaAnhiVodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vZXZjYTEtZzMuY3JsMIIBxAYD
-VR0gBIIBuzCCAbcwggGzBglghkgBhv1sAgEwggGkMDoGCCsGAQUFBwIBFi5odHRw
-Oi8vd3d3LmRpZ2ljZXJ0LmNvbS9zc2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYI
-KwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBmACAAdABoAGkAcwAg
-AEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABpAHQAdQB0AGUAcwAg
-AGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBl
-AHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBu
-AGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAg
-AGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAg
-AGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIABy
-AGUAZgBlAHIAZQBuAGMAZQAuMH0GCCsGAQUFBwEBBHEwbzAkBggrBgEFBQcwAYYY
-aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEcGCCsGAQUFBzAChjtodHRwOi8vY2Fj
-ZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZDQS0xLmNy
-dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBQUAA4IBAQA73oGzdoo0PYsbhWsR
-rfuEOrm3n6qCQ3yTQZZlLDJeJLjkGtfLM9Ktbt0ygyCRLgQkKbRu6D73Y8A0m9ky
-nQQKq6mQBdaAqVnu9VDVS8G6cVCWgQR1hjQWphskDAey1pOyL61ncvrN/goI9CU7
-L2KqYL4LBIKBPbsWXzBIe3y1pJpxyofWiYbwzL3jLwhwk2Uyr/WwwTtUvpd6iBxb
-pXo6N3SYrHke8oWlA94ijkzURqESYZaUWNh7IkQITA2reQW/jmvtGVR/ymssURiH
-bLxrI3r/M7w+9cc3lz9ZVTfanQTABdIo+TSZDc7XPoKNthBUQ+klO8cDQ/6lfjQS
-tUed
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
 MIIG5jCCBc6gAwIBAgIQAze5KDR8YKauxa2xIX84YDANBgkqhkiG9w0BAQUFADBs
 MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
 d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j

setup.py

@@ -36,5 +36,5 @@
       packages=['clever'],
       package_data={'clever' : ['data/clever.com_ca_bundle.crt', 'VERSION']},
       install_requires=install_requires,
-      #test_suite='test',
+      test_suite='test',
 )