Remove hard certifi dependency and document.

diff --git a/docs/user/advanced.rst b/docs/user/advanced.rst
index 0de6b1b17898ce4a707ecbe6f019ae5a4ddad075..d14b3555b3eb9906f85a6bfc14f549d04caf7463 100644 (file)
--- a/docs/user/advanced.rst
+++ b/docs/user/advanced.rst
@@ -741,3 +741,20 @@ coffee.
     r = requests.get('https://github.com', timeout=None)
 
 .. _`connect()`: http://linux.die.net/man/2/connect
+
+CA Certificates
+---------------
+
+By default Requests bundles a set of root CAs that it trusts, sourced from the
+Mozilla trust store. However, these are only updated once for each Requests
+version. This means that if you pin a Requests version your certificates can
+become extremely out of date.
+
+From Requests version 2.4.0 onwards, Requests will attempt to use certificates
+from `certifi`_ if it is present on the system. This allows for users to update
+their trusted certificates without having to change the code that runs on their
+system.
+
+For the sake of security we recommend upgrading certifi frequently!
+
+.. _certifi: http://certifi.io/

diff --git a/setup.py b/setup.py
index 9540a47ccc73d7997d9f0dfeb7e09341d1e0eede..b790ec71ab0c193360a7e250f0c05a2b61934960 100755 (executable)
--- a/setup.py
+++ b/setup.py
@@ -25,7 +25,7 @@ packages = [
     'requests.packages.urllib3.packages.ssl_match_hostname',
 ]
 
-requires = ['certifi']
+requires = []
 
 with open('README.rst') as f:
     readme = f.read()