<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">Fastly has announced plans to disable TLSv1.0 and TLSv1.1 on their CDN endpoints</div><div class="">which will include PyPI (as well as other Python properties). You can see their</div><div class="">timeline at <a href="https://www.fastly.com/blog/phase-two-our-tls-10-and-11-deprecation-plan" class="">https://www.fastly.com/blog/phase-two-our-tls-10-and-11-deprecation-plan</a>.</div><div class=""><br class=""></div><div class="">There are two hard cut off dates to remember:</div><div class=""><br class=""></div><div class="">* April 30, 2017, which is when any <a href="http://Python.org" class="">Python.org</a> site you see that does *not*</div><div class=""> have an EV certificate that is hosted by Fastly will no longer support</div><div class=""> TLSv1.0 and TLSv1.1 (<a href="http://testpypi.python.org" class="">testpypi.python.org</a>, <a href="http://test.pypi.org" class="">test.pypi.org</a>,</div><div class=""> <a href="http://files.pythonhosted.org" class="">files.pythonhosted.org</a>, etc). This will affect Warehouse since that uses</div><div class=""> <a href="http://files.pythonhosted.org" class="">files.pythonhosted.org</a> to serve files.</div><div class=""><br class=""></div><div class="">* June 30, 2018, which is when any <a href="http://Python.org" class="">Python.org</a> site you see that has an EV</div><div class=""> certificate that is hosted by Fastly will no longer support TSLv1.0 and</div><div class=""> TLSv1.1 (<a href="http://pypi.python.org" class="">pypi.python.org</a>, <a href="http://pypi.org" class="">pypi.org</a>, etc).</div><div class=""><br class=""></div><div class="">I am going to see about possibly organizing some scheduled "brown outs" of</div><div class="">TLSv1.0 and TLSv1.1 prior to the cut off dates to try and help folks find places</div><div class="">that will need updates. Any scheduled brownouts will be posted to</div><div class=""><a href="http://status.python.org" class="">status.python.org</a> prior to happening.</div><div class=""><br class=""></div><div class="">Looking at the download numbers, the absolute largest driver of TLSv1.0 and</div><div class="">TLSv1.1 traffic to PyPI are old versions of pip or other clients where I cannot</div><div class="">tell the OS that they are being run on. Past that, macOS is going to be the</div><div class="">largest casualty since their system Python does not support TLSv1.2 yet in any</div><div class="">version of their OS.</div><div class=""><br class=""></div><div class="">If you have a Python and you want to check to see if it supports TLSv1.2 or not,</div><div class="">the easiest way to do that is by running:</div><div class=""><br class=""></div><div class=""> python2 -c "import urllib2,json; print(json.loads(urllib2.urlopen('<a href="https://www.howsmyssl.com/a/check" class="">https://www.howsmyssl.com/a/check</a>').read())['tls_version'])"</div><div class=""><br class=""></div><div class=""> OR</div><div class=""><br class=""></div><div class=""> python3 -c "import urllib.request,json; print(json.loads(urllib.request.urlopen('<a href="https://www.howsmyssl.com/a/check" class="">https://www.howsmyssl.com/a/check</a>').read())['tls_version'])"</div><div class=""><br class=""></div><div class="">If you get something other than TLS 1.2, then I suggest making plans to deal</div><div class="">with the inevitable breakage which may start occurring on or before April 30,</div><div class="">2017.</div></div><br class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class="">—<br class="">Donald Stufft<br class=""></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>