Why do you call this dead code? Fedora may always use ca=serverca, but other instances may differ.

The client CA only needs to be set on the server side, because it is used to tell the client which CAs are accepted, see http://pyopenssl.sourceforge.net/pyOpenSSL.html/openssl-context.html

Therefore the option only makes sense if the koji daemon would terminate TLS itself and then only for the daemon. But afaics it is only used in a client context. I believe we even talked about this at FOSDEM or Devconf and you (or maybe Dennis) told me, that the code is only there, because this is code that was taken from plague and plague used to be different.

Also of interest -- https://github.com/pyca/pyopenssl/issues/387
I'm not sure whether to laugh or cry.

This looks fine. I'll pull it in.

Also of interest -- https://github.com/pyca/pyopenssl/issues/387
I'm not sure whether to laugh or cry.

This looks fine. I'll pull it in.