On Tue, 12 Feb 2008, Dan Fandrich wrote:

> Just who is the audience for a certificate bundle included with curl? Is it
> distribution package maintainers? No, they maintain their own bundles
> separately and won't bother with a curl bundle. Is it users? No, not most
> of them because their OS distribution already includes an up-to-date bundle.

Thanks for keeping your head cool and asking the right questions.

Of course you're right. I don't see very many users that will care about this
bundle in practise when shipped from us, and for those that do it is very easy
to get an updated one. Especially now with Gunter's new bundled fancy script.

Possibly we should then, as you suggested as an alternative, rather completely
rip out the existing ca-cert bundle since out of the few users who (think
they) need a ca cert bundle from us there might be a certain amount who get
tricked by our current file and believe it is actually a good enough bundle to
use in production.

-- 
  Commercial curl and libcurl Technical Support: http://haxx.se/curl.html