Repository: conda/conda

Issue:
ssl_verify functionality doesn't match description
Was experimenting to see if I could use a cert directory on Windows 7:
```
> conda config --set ssl_verify C:\Users\HarmerS\certs
```

However it seems like the description of `ssl_verify` doesn't agree with the implementation.
```
> conda config --describe
[...]
ssl_verify (basestring, bool)
  default: true
  aliases: insecure, verify_ssl
  Conda verifies SSL certificates for HTTPS requests, just like a web
  browser. By default, SSL verification is enabled, and conda operations
  will fail if a required url's certificate cannot be verified. Setting
  ssl_verify to False disables certification verificaiton. The value for
  ssl_verify can also be (1) a path to a CA bundle file, or (2) a path
  to a directory containing certificates of trusted CA.
[...]

> conda install -c conda-forge pydicom

CustomValidationError: Parameter ssl_verify = 'C:\\Users\\HarmerS\\certs' declared in <<merged>> is invalid.
ssl_verify value 'C:\Users\HarmerS\certs' must be a boolean or a path to a certificate bundle.
```


```
> conda --version
conda 4.3.25
```
Via Miniconda 4.3.21 [installer](https://repo.continuum.io/miniconda/Miniconda2-latest-Windows-x86.exe) Python 2.7 32-bit + `conda update conda` on Windows 7 64-bit.

I would prefer to have the feature of using a cert directory (much easier to manage) so I raised the issue here rather than under conda-docs.
ssl_verify functionality doesn't match description
Was experimenting to see if I could use a cert directory on Windows 7:
```
> conda config --set ssl_verify C:\Users\HarmerS\certs
```

However it seems like the description of `ssl_verify` doesn't agree with the implementation.
```
> conda config --describe
[...]
ssl_verify (basestring, bool)
  default: true
  aliases: insecure, verify_ssl
  Conda verifies SSL certificates for HTTPS requests, just like a web
  browser. By default, SSL verification is enabled, and conda operations
  will fail if a required url's certificate cannot be verified. Setting
  ssl_verify to False disables certification verificaiton. The value for
  ssl_verify can also be (1) a path to a CA bundle file, or (2) a path
  to a directory containing certificates of trusted CA.
[...]

> conda install -c conda-forge pydicom

CustomValidationError: Parameter ssl_verify = 'C:\\Users\\HarmerS\\certs' declared in <<merged>> is invalid.
ssl_verify value 'C:\Users\HarmerS\certs' must be a boolean or a path to a certificate bundle.
```


```
> conda --version
conda 4.3.25
```
Via Miniconda 4.3.21 [installer](https://repo.continuum.io/miniconda/Miniconda2-latest-Windows-x86.exe) Python 2.7 32-bit + `conda update conda` on Windows 7 64-bit.

I would prefer to have the feature of using a cert directory (much easier to manage) so I raised the issue here rather than under conda-docs.


Discussion:
Conda just uses requests under the hood.  Is what you're proposing compatible with http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification ? If so, we can absolutely update all associated docs.

For reference, the documentation shown by `conda config --describe` is at https://github.com/conda/conda/blob/4.3.x/conda/base/context.py#L686
Conda just uses requests under the hood.  Is what you're proposing compatible with http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification ? If so, we can absolutely update all associated docs.

For reference, the documentation shown by `conda config --describe` is at https://github.com/conda/conda/blob/4.3.x/conda/base/context.py#L686

Resolving patch:
diff --git a/conda/base/context.py b/conda/base/context.py
--- a/conda/base/context.py
+++ b/conda/base/context.py
@@ -95,9 +95,10 @@ def default_python_validation(value):
 
 def ssl_verify_validation(value):
     if isinstance(value, string_types):
-        if not isfile(value):
-            return ("ssl_verify value '%s' must be a boolean or a path to a "
-                    "certificate bundle." % value)
+        if not isfile(value) and not isdir(value):
+            return ("ssl_verify value '%s' must be a boolean, a path to a "
+                    "certificate bundle file, or a path to a directory containing "
+                    "certificates of trusted CAs." % value)
     return True
 
 
@@ -147,7 +148,7 @@ class Context(Configuration):
 
     # remote connection details
     ssl_verify = PrimitiveParameter(True, element_type=string_types + (bool,),
-                                    aliases=('insecure', 'verify_ssl',),
+                                    aliases=('verify_ssl',),
                                     validation=ssl_verify_validation)
     client_ssl_cert = PrimitiveParameter(None, aliases=('client_cert',),
                                          element_type=string_types + (NoneType,))
diff --git a/conda/cli/conda_argparse.py b/conda/cli/conda_argparse.py
--- a/conda/cli/conda_argparse.py
+++ b/conda/cli/conda_argparse.py
@@ -1265,6 +1265,7 @@ def add_parser_insecure(p):
     p.add_argument(
         "-k", "--insecure",
         action="store_false",
+        dest="ssl_verify",
         default=NULL,
         help="Allow conda to perform \"insecure\" SSL connections and transfers. "
              "Equivalent to setting 'ssl_verify' to 'false'."


Test patch:
diff --git a/tests/test_create.py b/tests/test_create.py
--- a/tests/test_create.py
+++ b/tests/test_create.py
@@ -869,7 +869,7 @@ def test_conda_config_validate(self):
                     run_command(Commands.CONFIG, prefix, "--validate")
 
                 assert len(exc.value.errors) == 2
-                assert "must be a boolean or a path to a certificate bundle" in str(exc.value)
+                assert "must be a boolean, a path to a certificate bundle file, or a path to a directory containing certificates of trusted CAs" in str(exc.value)
                 assert "default_python value 'anaconda' not of the form '[23].[0-9]'" in str(exc.value)
             finally:
                 reset_context()