platformTrust() - for now, give up and use certifi

	@glyph reported
Trac ID	trac#8201
Type	defect
Created	2016-02-09 21:06:37Z

Right now, Twisted is depending on OpenSSL being configured correctly to make client connections.

The hack we were depending on to get actual platform trust roots in OS X has disappeared; nothing equivalent exists on Windows; the way that Cryptography wheels are distributed means that it's likely the user gets an OpenSSL pointing at a default path that doesn't even exist on their system. Nobody knows how to properly enable/disable trust roots on Debian and their trust store is out of date anyway.

For the time being, I think the best solution is to switch to twisted[tls] depending on certifi and making platformTrust prefer certifi if it is importable.

trac-id__8201 8201
type__defect defect
reporter__glyph glyph
priority__normal normal
milestone__None None
branch__ 
branch_author__ 
status__new new
resolution__None None
component__core core
keywords__None None
time__1455051997170004 1455051997170004
changetime__1468886895718712 1468886895718712
version__None None
owner__None None

Start by locating the platformTrust entry point and the dependency configuration for twisted[tls]. Review how client trust roots are selected across operating systems, then verify that certifi is preferred when importable. Done means the intended dependency and fallback behavior are covered by the relevant TLS tests.