[Catalog-sig] SSL for PyPI

[William McVey]

On Wed, Feb 24, 2010 at 12:53 PM, "Martin v. Löwis" <martin at v.loewis.de> wrote:
> Notice that it already supports SSH access for this very purpose. SSL
> access could be provided, but would cause an ongoing maintenance issue
> (requiring regular updates of the server certificate, unless self-signed
> long-running certificates are used).


The general public can't use the ssh interface for package downloads
though, can it? SSL would require periodic replacement of server
certificates, but this is fairly straightforward to manage as part of
the domain renewal process (or as some other related administrative
process), and doesn't have to be too onerous. A 5 year cert can be
purchased for $141 (through domaindiscover... no guarantee that they
have the best price, it's just the one I have bookmarked). I'd be
happy to assist in any way you might find useful.

  -- William