I am building vim from source and keep having to update the SSL hostfingerprints of my ~/.hgrc file. It's getting a little silly and large – see below. The pattern is the same: run update, find SSL finger print has changed, update fingerprint…

Anyone knows of a simpler way to keep this updated?

### openssl s_client -connect  vim.googlecode.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
[hostfingerprints]

-

Have a look at http://mercurial.selenic.com/wiki/CACertificates - it should be enough to specify the cacerts. In short don't depend on the specific fingerprint but check if the cert is signed by a trusted source.

For Debian/Ubuntu/Arch/Gentoo:

[web]
cacerts = /etc/ssl/certs/ca-certificates.crt


Fedora/RHEL:

[web]
cacerts = /etc/pki/tls/certs/ca-bundle.crt

-
That seems to work. Thank you. –  Sardathrion Jun 25 '12 at 7:13
Or if you don't want to trust every certificate authority, you can download only the Google Internet Authority CA certificate from gstatic.com/GoogleInternetAuthority/GoogleInternetAuthority.crt. –  Mikel Jun 26 '12 at 4:28
For OS-X: brew install curl-ca-bundle and then point cacerts at /usr/local/share/ca-bundle.crt –  The Doctor What Apr 25 '13 at 0:37