Merge lp:~brian.curtin/ubuntu-sso-client/local-certs into lp:ubuntu-sso-client

[Brian Curtin]

- Set SSL configuration with bundled certificates for all WebClient requests

Explicitly use the certificates we bundle with installations, fixing a longstanding problem on some Windows systems where the required certificates are not typically available.

Note: as this branch is going to be applied manually to a stable branch, it includes get_cert_location (from storage-protocol). This should be factored out to a more commonly usable location moving forward.

[dobey (dobey)]

So, I am uncertain about this branch implementation. This effectively introduces a dependency on ubuntuone-storage-protocol in ubuntu-sso-client, only for a few .crt files. We should probably move those files (probably to ubuntuone-client-data or similar), to keep the dependencies sane, and from getting circular. I especially don't like duplicating the code that's in there.

I'd also like to confirm whether this will break ubuntu-sso-client on Linux, when the storage protocol packages aren't installed, as other applications may/do use ubuntu-sso-client for authentication.

Shipping this as a stop-gap patch on Windows to deal with the existing problem is fine by me, but I'm not sure this should land in trunk (or any stable branches) as-is.

review: Needs Information

[Brian Curtin (brian.curtin)]

1. I'm fine with moving the files to ubuntuone-client-data. If that's acceptable, I'll go ahead and do it.
2. I don't like duplicating the code either, but I've had my "release Windows ASAP" hat on. Given the dependency situation that we want to step around, where can I feasibly put get_cert_location? dirspec, devtools?
3. As for breakage on Linux without storage-protocol or those specific certs - it shouldn't affect it. If nothing turns up when we go to look for our specific certs, they just won't be configured. test_setup_no_certs checks this by faking out the search for "UbuntuOne*.crt" with an empty list and ensures that WebClient can still start up.
4. Perhaps I've been focused too much on the stop-gap approach, but I'm all for doing this properly the first time. I don't really like this MP as-is, but could use this type of response to get it into shape.

[dobey (dobey)]

On Fri, 2012-11-02 at 19:49 +0000, Brian Curtin wrote:
> 1. I'm fine with moving the files to ubuntuone-client-data. If that's
> acceptable, I'll go ahead and do it.

There are some packaging concerns here, so needs a bit of coordination
to do. And given 2.) below, I need to think about this a little bit
more, I suppose.

> 2. I don't like duplicating the code either, but I've had my "release
> Windows ASAP" hat on. Given the dependency situation that we want to
> step around, where can I feasibly put get_cert_location? dirspec,
> devtools?

The API call and the cert files should be in the same project I think,
but this does also mean we need to think a bit more about where to put
those files and API exactly.

> 3. As for breakage on Linux without storage-protocol or those specific
> certs - it shouldn't affect it. If nothing turns up when we go to look
> for our specific certs, they just won't be configured.
> test_setup_no_certs checks this by faking out the search for
> "UbuntuOne*.crt" with an empty list and ensures that WebClient can
> still start up.

Great.

> 4. Perhaps I've been focused too much on the stop-gap approach, but
> I'm all for doing this properly the first time. I don't really like
> this MP as-is, but could use this type of response to get it into
> shape.

It will require a bit more thought and work, so I think for now, the
best solution for getting a new Windows release out, is to use this
(though I would change the duplicated code to just import the call from
ubuntuone.storageprotocol.context to reduce the size of the patch, and
any potential for issues due to the code duplication.

[dobey (dobey)]

As we discussed on IRC yesterday, we should build a windows release from stable-4-0 with the current patch as-is, to get a working release built and released. Once that's done, this branch should be updated to pull in the .crt files and install them into the ubuntu-sso-client data directory, and pull in the get_certificates() method and related tests, tweaked to look for the certs in the new location. Once in, and packaged up in our nightlies, we can update ubuntuone-storage-protocol (which I've already added to the bug as being affected), to use the API/certs from SSO, and remove them from storage-protocol.

review: Needs Fixing

[lp:~brian.curtin/ubuntu-sso-client/local-certs]

1012. By dobey on 2012-12-06

Bump version number for trunk.

1013. By dobey on 2012-12-14

Ignore some new pep8 errors, and update code to fix others.

1014. By Mike McCracken on 2012-12-14

- Add util func returning translation function for platform/pyversion/frozen status. (LP: #1074116)

1015. By Alejandro J. Cura on 2013-01-15

- Use a standard LC_CTYPE locale when the LANG is turkish. (LP: #997326).

1016. By Alejandro J. Cura on 2013-01-18

Clean up timers that are sometimes slowing down all tests that follow.

1017. By dobey on 2013-01-24

Fail the defer with an exception class like it's supposed to.

1018. By dobey on 2013-01-25

Fix a dependency on a re-export of a module in twisted.

1019. By dobey on 2013-02-08

Skip proxy tests failing due to ncsa_auth crashing.

1020. By Barry Warsaw on 2013-02-11

Switch from python-oauth to python-oauthlib for using OAuth.

1021. By Barry Warsaw on 2013-02-12

Remove some unnecessary test code that still depended on python-oauth.

1022. By dobey on 2013-02-15

Pass the timestamp argument to oauthlib as a str to workaround a problem.

1023. By dobey on 2013-02-20

Don't pass in the query parameters to oauthlib twice.

1024. By dobey on 2013-03-21

Add the version to constants.py as well.
Replace PROJECT_NAME as well to have a single location for it.
Generate the constants.py as a usable module from within tests.
Replace the prefix in constants.py only in the installed copy, and not local.
Use the correct variable for replacing the "prefix" in constants.py.
Update author information in setup().

1025. By Diego Sarmentero on 2013-03-21

Update to use Ubuntu One branding and URLs.

1026. By dobey on 2013-03-29

Unify usage of login and u1 host into environment variables, for testing.

1027. By dobey on 2013-04-03

Only replace root in the install_data string when root is set.

1028. By dobey on 2013-04-12

Handle the API changing in 0.3.8 by avoiding passing in params for GET/HEAD.

1029. By Leo Arias on 2013-04-19

Changed the environment variables for sso auth and uone from hosts to urls.

1030. By Leo Arias on 2013-05-06

Fix typo on the ubuntuone environment variable.

1031. By Brian Curtin on 2013-05-08

Merge trunk

1032. By Brian Curtin on 2013-05-08

Add pem files to data"

1033. By Brian Curtin on 2013-05-08

Add get_cert_dir (was get_cert_location in storageprotocol)

1034. By Brian Curtin on 2013-05-08

Rework setup

[dobey (dobey)]

There are some tests in ubuntuone-storage-protocol's test_context.py which should be copied over in this branch, to test the get_cert_dir method added here. The SSLCertLocationTestCase in its entirety, updated to use the new method. Also, is there a good reason to rename the method to get_cert_dir here? Keeping the name as _location would be fine.

review: Needs Fixing

[lp:~brian.curtin/ubuntu-sso-client/local-certs]

1035. By Brian Curtin on 2013-05-22

Add tests from storageprotocol's implementation of get_cert_{location|dir}

[Brian Curtin (brian.curtin)]

Copied the tests over and they pass. Already explained the name change on IRC, but it was done to match the other get_* functions in the utils module.

[lp:~brian.curtin/ubuntu-sso-client/local-certs]

1036. By Brian Curtin on 2013-05-22

Remove commented lines from test

[dobey (dobey)]

review: Approve

[Mike McCracken (mikemc)]

Looks fine to me, and tests do pass on osx.

review: Approve

=== added file 'data/UbuntuOne-Go_Daddy_CA.pem'
--- data/UbuntuOne-Go_Daddy_CA.pem	1970-01-01 00:00:00 +0000
+++ data/UbuntuOne-Go_Daddy_CA.pem	2013-05-22 20:16:26 +0000
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE3jCCA8agAwIBAgICAwEwDQYJKoZIhvcNAQEFBQAwYzELMAkGA1UEBhMCVVMx
+ITAfBgNVBAoTGFRoZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28g
+RGFkZHkgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjExMTYw
+MTU0MzdaFw0yNjExMTYwMTU0MzdaMIHKMQswCQYDVQQGEwJVUzEQMA4GA1UECBMH
+QXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEaMBgGA1UEChMRR29EYWRkeS5j
+b20sIEluYy4xMzAxBgNVBAsTKmh0dHA6Ly9jZXJ0aWZpY2F0ZXMuZ29kYWRkeS5j
+b20vcmVwb3NpdG9yeTEwMC4GA1UEAxMnR28gRGFkZHkgU2VjdXJlIENlcnRpZmlj
+YXRpb24gQXV0aG9yaXR5MREwDwYDVQQFEwgwNzk2OTI4NzCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMQt1RWMnCZM7DI161+4WQFapmGBWTtwY6vj3D3H
+KrjJM9N55DrtPDAjhI6zMBS2sofDPZVUBJ7fmd0LJR4h3mUpfjWoqVTr9vcyOdQm
+VZWt7/v+WIbXnvQAjYwqDL1CBM6nPwT27oDyqu9SoWlm2r4arV3aLGbqGmu75RpR
+SgAvSMeYddi5Kcju+GZtCpyz8/x4fKL4o/K1w/O5epHBp+YlLpyo7RJlbmr2EkRT
+cDCVw5wrWCs9CHRK8r5RsL+H0EwnWGu1NcWdrxcx+AuP7q2BNgWJCJjPOq8lh8BJ
+6qf9Z/dFjpfMFDniNoW1fho3/Rb2cRGadDAW/hOUoz+EDU8CAwEAAaOCATIwggEu
+MB0GA1UdDgQWBBT9rGEyk2xF1uLuhV+auud2mWjM5zAfBgNVHSMEGDAWgBTSxLDS
+kdRMEXGzYcs9of7dqGrU4zASBgNVHRMBAf8ECDAGAQH/AgEAMDMGCCsGAQUFBwEB
+BCcwJTAjBggrBgEFBQcwAYYXaHR0cDovL29jc3AuZ29kYWRkeS5jb20wRgYDVR0f
+BD8wPTA7oDmgN4Y1aHR0cDovL2NlcnRpZmljYXRlcy5nb2RhZGR5LmNvbS9yZXBv
+c2l0b3J5L2dkcm9vdC5jcmwwSwYDVR0gBEQwQjBABgRVHSAAMDgwNgYIKwYBBQUH
+AgEWKmh0dHA6Ly9jZXJ0aWZpY2F0ZXMuZ29kYWRkeS5jb20vcmVwb3NpdG9yeTAO
+BgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQEFBQADggEBANKGwOy9+aG2Z+5mC6IG
+OgRQjhVyrEp0lVPLN8tESe8HkGsz2ZbwlFalEzAFPIUyIXvJxwqoJKSQ3kbTJSMU
+A2fCENZvD117esyfxVgqwcSeIaha86ykRvOe5GPLL5CkKSkB2XIsKd83ASe8T+5o
+0yGPwLPk9Qnt0hCqU7S+8MxZC9Y7lhyVJEnfzuz9p0iRFEUOOjZv2kWzRaJBydTX
+RE4+uXR21aITVSzGh6O1mawGhId/dQb8vxRMDsxuxN89txJx9OjxUUAiKEngHUuH
+qDTMBqLdElrRhjZkAzVvb3du6/KFUJheqwNTrZEjYx8WnM25sgVjOuH0aBsXBTWV
+U+4=
+-----END CERTIFICATE-----

=== added file 'data/UbuntuOne-Go_Daddy_Class_2_CA.pem'
--- data/UbuntuOne-Go_Daddy_Class_2_CA.pem	1970-01-01 00:00:00 +0000
+++ data/UbuntuOne-Go_Daddy_Class_2_CA.pem	2013-05-22 20:16:26 +0000
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJV
+UzEhMB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQL
+EyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4X
+DTA0MDYyOTE3MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMx
+ITAfBgNVBAoTGFRoZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMo
+R28gRGFkZHkgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAw
+DQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d
+/+TvZxz0ZWizV3GgXne77ZtJ6XCAPVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9
+S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6wwdhFJ2+qN1j3hybX2C32qRe3H3I2
+TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXiEqITLdiOr18SPaAIBQi2XKVl
+OARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMYavx4A6lNf4DD+qta/KFA
+pMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+YihfukEHU1jPEX44
+dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLEsNKR1EwRcbNh
+yz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h/t2oatTj
+oWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5IEdy
+b3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj
+YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF
+BQADggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYX
+MP80kWNyOO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKt
+I3lpjbi2Tc7PTMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheab
+IZ0KbIIOqPjCDPoQHmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzr
+Tia2cyvk0/ZM/iZx4mERdEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBD
+pqWeCtWVYpoNz4iCxTIM5CufReYNnyicsbkqWletNw+vHX/bvZ8=
+-----END CERTIFICATE-----

=== added file 'data/UbuntuOne-ValiCert_Class_2_VA.pem'
--- data/UbuntuOne-ValiCert_Class_2_VA.pem	1970-01-01 00:00:00 +0000
+++ data/UbuntuOne-ValiCert_Class_2_VA.pem	2013-05-22 20:16:26 +0000
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0
+IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz
+BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y
+aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG
+9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNjAwMTk1NFoXDTE5MDYy
+NjAwMTk1NFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y
+azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs
+YXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw
+Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl
+cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY
+dA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9
+WlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS
+v4dk+NoS/zcnwbNDu+97bi5p9wIDAQABMA0GCSqGSIb3DQEBBQUAA4GBADt/UG9v
+UJSZSWI4OB9L+KXIPqeCgfYrx+jFzug6EILLGACOTb2oWH+heQC1u+mNr0HZDzTu
+IYEZoDJJKPTEjlbVUjP9UNV+mWwD5MlM/Mtsq2azSiGM5bUMMj4QssxsodyamEwC
+W/POuZ6lcg5Ktz885hZo+L7tdEy8W9ViH0Pd
+-----END CERTIFICATE-----

=== modified file 'setup.py'
--- setup.py	2013-04-03 18:50:39 +0000
+++ setup.py	2013-05-22 20:16:26 +0000
@@ -47,6 +47,8 @@
 
 from distutils import log
 
+from ubuntu_sso.utils import get_cert_dir
+
 PROJECT_NAME = 'ubuntu-sso-client'
 VERSION = '4.3'
 
@@ -285,14 +287,17 @@
     cmdclass['build_i18n'] = dummy_build_i18n
 
 
-def setup_windows():
-    """Provide the required info to setup the project on windows."""
+data_files = [(get_cert_dir(),
+              ['data/UbuntuOne-Go_Daddy_CA.pem',
+               'data/UbuntuOne-ValiCert_Class_2_VA.pem',
+               'data/UbuntuOne-Go_Daddy_Class_2_CA.pem'])]
+
+if sys.platform == 'win32':
     set_py2exe_paths()
-    _data_files = []
     # for PyQt, see http://www.py2exe.org/index.cgi/Py2exeAndPyQt
     _includes = ['sip', 'email', 'ubuntu_sso.qt.gui',
                  'ubuntu_sso.qt.controllers', 'PyQt4.QtNetwork', 'PIL']
-    _extra = {
+    extra = {
         'options': {
             'py2exe': {
                 'bundle_files': 1,
@@ -306,15 +311,11 @@
         'console': sso_executables,
         'zipfile': None,
     }
-    return _data_files, _extra
-
-if sys.platform == 'win32':
-    data_files, extra = setup_windows()
 else:
-    data_files = [
+    data_files.extend([
         ('lib/ubuntu-sso-client', sso_executables),
         ('share/dbus-1/services', ['data/com.ubuntu.sso.service']),
-    ]
+    ])
     extra = {}
 
 DistUtilsExtra.auto.setup(

=== modified file 'ubuntu_sso/utils/__init__.py'
--- ubuntu_sso/utils/__init__.py	2012-10-23 14:17:58 +0000
+++ ubuntu_sso/utils/__init__.py	2013-05-22 20:16:26 +0000
@@ -33,6 +33,7 @@
 import os
 import sys
 
+from dirspec.basedir import load_config_paths
 from dirspec.utils import get_program_path
 
 from twisted.internet import defer
@@ -141,6 +142,30 @@
     return cmd_args
 
 
+def get_cert_dir():
+    """Return directory containing certificate files."""
+
+    if getattr(sys, "frozen", None) is not None:
+        if sys.platform == "win32":
+            ssl_cert_location = list(load_config_paths(
+                    "ubuntuone"))[1]
+        elif sys.platform == "darwin":
+                main_app_dir = "".join(__file__.partition(".app")[:-1])
+                main_app_resources_dir = os.path.join(main_app_dir,
+                                                      "Contents",
+                                                      "Resources")
+                ssl_cert_location = main_app_resources_dir
+    elif any(plat in sys.platform for plat in ("win32", "darwin")):
+        pkg_dir = os.path.dirname(__file__)
+        src_tree_path = os.path.dirname(os.path.dirname(pkg_dir))
+        ssl_cert_location = os.path.join(src_tree_path,
+                                         "data")
+    else:
+        ssl_cert_location = '/etc/ssl/certs'
+
+    return ssl_cert_location
+
+
 @defer.inlineCallbacks
 def ping_url(url, email, credentials):
     """Ping the 'url' with the 'email' attached to it.

=== modified file 'ubuntu_sso/utils/tests/test_common.py'
--- ubuntu_sso/utils/tests/test_common.py	2013-02-11 21:52:34 +0000
+++ ubuntu_sso/utils/tests/test_common.py	2013-05-22 20:16:26 +0000
@@ -32,6 +32,7 @@
 
 import logging
 import sys
+import os
 
 from twisted.internet import defer
 from twisted.web import resource
@@ -167,6 +168,49 @@
         self.assertEqual(expected, result)
 
 
+class GetCertDirTestCase(TestCase):
+    """Test determining the cert location."""
+
+    @defer.inlineCallbacks
+    def setUp(self):
+        yield super(GetCertDirTestCase, self).setUp()
+
+    def test_win(self):
+        """Test geting a path when Common AppData is defined."""
+        self.patch(utils, "__file__",
+                   os.path.join("path", "to", "ubuntu_sso",
+                                "utils", "__init__.py"))
+        self.patch(sys, "platform", "win32")
+        path = utils.get_cert_dir()
+        self.assertEqual(path, os.path.join("path", "to", "data"))
+
+    def test_darwin_frozen(self):
+        """Test that we get a path with .app in it on frozen darwin."""
+        self.patch(sys, "platform", "darwin")
+        sys.frozen = "macosx-app"
+        self.addCleanup(delattr, sys, "frozen")
+        self.patch(utils, "__file__",
+                   os.path.join("path", "to", "Main.app", "ignore"))
+        path = utils.get_cert_dir()
+        self.assertEqual(path, os.path.join("path", "to", "Main.app",
+                                            "Contents", "Resources"))
+
+    def test_darwin_unfrozen(self):
+        """Test that we get a source-relative path on unfrozen darwin."""
+        self.patch(sys, "platform", "darwin")
+        self.patch(utils, "__file__",
+                   os.path.join("path", "to", "ubuntuone",
+                                "utils", "__init__.py"))
+        path = utils.get_cert_dir()
+        self.assertEqual(path, os.path.join("path", "to", "data"))
+
+    def test_linux(self):
+        """Test that linux gets the right path."""
+        self.patch(sys, "platform", "linux2")
+        path = utils.get_cert_dir()
+        self.assertEqual(path, "/etc/ssl/certs")
+
+
 class RootResource(resource.Resource):
     """A root resource that logs the number of calls."""
 

=== modified file 'ubuntu_sso/utils/webclient/qtnetwork.py'
--- ubuntu_sso/utils/webclient/qtnetwork.py	2013-03-28 21:50:02 +0000
+++ ubuntu_sso/utils/webclient/qtnetwork.py	2013-05-22 20:16:26 +0000
@@ -30,6 +30,8 @@
 
 from __future__ import unicode_literals
 
+import glob
+import os
 import sys
 from io import StringIO
 
@@ -47,10 +49,12 @@
     QNetworkReply,
     QNetworkRequest,
     QSslCertificate,
+    QSslConfiguration,
 )
 from twisted.internet import defer
 
 from ubuntu_sso.logger import setup_logging
+from ubuntu_sso.utils import get_cert_dir
 from ubuntu_sso.utils.webclient.common import (
     BaseWebClient,
     HeaderDict,
@@ -102,6 +106,25 @@
         self.proxy_retry = False
         self.setup_proxy()
 
+        # Apply our local certificates as the SSL configuration to be used
+        # for all QNetworkRequest calls.
+        self.ssl_config = QSslConfiguration.defaultConfiguration()
+        ca_certs = self.ssl_config.caCertificates()
+        try:
+            for path in glob.glob(os.path.join(get_cert_dir(),
+                                               "UbuntuOne*.pem")):
+                with open(path) as f:
+                    cert = QSslCertificate(f.read())
+                    if cert.isValid():
+                        ca_certs.append(cert)
+                    else:
+                        logger.error("invalid certificate: {}".format(path))
+        except (IndexError, IOError) as err:
+            raise WebClientError(
+                    "Unable to configure SSL certificates: {}".format(err))
+
+        self.ssl_config.setCaCertificates(ca_certs)
+
     def _set_proxy(self, proxy):
         """Set the proxy to be used."""
         QNetworkProxy.setApplicationProxy(proxy)
@@ -157,6 +180,7 @@
         """Return a deferred that will be fired with a Response object."""
         uri = self.iri_to_uri(iri)
         request = QNetworkRequest(QUrl(uri))
+        request.setSslConfiguration(self.ssl_config)
         headers = yield self.build_request_headers(uri, method, extra_headers,
                                                    oauth_credentials)
 

=== modified file 'ubuntu_sso/utils/webclient/tests/test_qtnetwork.py'
--- ubuntu_sso/utils/webclient/tests/test_qtnetwork.py	2012-12-14 22:06:47 +0000
+++ ubuntu_sso/utils/webclient/tests/test_qtnetwork.py	2013-05-22 20:16:26 +0000
@@ -47,6 +47,8 @@
         self.settings = dict(https=dict(username='user', password='pasword'))
         self.patch(qtnetwork.gsettings, 'get_proxy_settings',
                 lambda: self.settings)
+        self.patch(qtnetwork, "get_cert_dir", lambda: "")
+        self.patch(qtnetwork.glob, "glob", lambda dir: [])
 
         self.proxy = None
 
@@ -69,6 +71,21 @@
     def _clean_webclient_instance(self):
         """Set the webclient not to have a proxy."""
         qtnetwork.WebClient.proxy_instance = None
+
+    def test_setup_no_certs(self):
+        # Ensure WebClient can start even if it finds no certs.
+        # It may or may not end up working depending on the certs actually
+        # being in the system, but not having them locally shouldn't prevent
+        # startup.
+        qtnetwork.WebClient()
+
+    def test_setup_unreadable_cert(self):
+        # If for some reason a cert of our own is found but can't be read,
+        # make sure we raise WebClientError.
+        # glob only returns paths that actually exist, but we fake this by
+        # passing something that can't be opened.
+        self.patch(qtnetwork.glob, "glob", lambda dir: ["asdfasdfasdf"])
+        self.assertRaises(qtnetwork.WebClientError, qtnetwork.WebClient)
 
 
 class SetupLinuxProxyTestCase(SetupProxyTestCase):