Remove hard certifi dependency and document.
diff --git a/docs/user/advanced.rst b/docs/user/advanced.rst
index 0de6b1b178..df653d0882 100644
--- a/docs/user/advanced.rst
+++ b/docs/user/advanced.rst
@@ -741,3 +741,21 @@ coffee.
     r = requests.get('https://github.com', timeout=None)
 
 .. _`connect()`: http://linux.die.net/man/2/connect
+
+CA Certificates
+---------------
+
+By default Requests bundles a set of root CAs that it trusts, sourced from the
+`Mozilla trust store`_. However, these are only updated once for each Requests
+version. This means that if you pin a Requests version your certificates can
+become extremely out of date.
+
+From Requests version 2.4.0 onwards, Requests will attempt to use certificates
+from `certifi`_ if it is present on the system. This allows for users to update
+their trusted certificates without having to change the code that runs on their
+system.
+
+For the sake of security we recommend upgrading certifi frequently!
+
+.. _certifi: http://certifi.io/
+.. _Mozilla trust store: https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt
diff --git a/setup.py b/setup.py
index 9540a47ccc..b790ec71ab 100755
--- a/setup.py
+++ b/setup.py
@@ -25,7 +25,7 @@
     'requests.packages.urllib3.packages.ssl_match_hostname',
 ]
 
-requires = ['certifi']
+requires = []
 
 with open('README.rst') as f:
     readme = f.read()

As discussed in #2124.
