Sitting in a corporate environment trying to access outside resources such as NPM packages or URL's using Python has become problematic in my company. With the recent changes to the SSL libraries there are now issues with certificate verification.

It is generally considered unsafe to set Unsafe Legacy Renegotiation due to the possibility of a man in the middle attack. I was wondering however whether this was the case within a corporate environment.

If this is all being handled by the corporate certs, is the risk only from a MITM only existing within the corporate network? My understanding is that the responsibility is really being offloaded to whatever service is swapping out the certs for anything external. So in theory if I trust the local network there should be no risk?

  • 1
    I'm wondering what exactly is causing the problem. It looks like your entreprise MITM proxy is quite oudated (does not support secure renegotiation?) which would be quite bad for a security solution.
    – ysdx
    Aug 18, 2023 at 23:47


You must log in to answer this question.

Browse other questions tagged .