Re: Builtin GnuTLS support and certificate verification

[Vincent Bernat <bernat@luffy.cx>]

 ❦  2 novembre 2013 12:27 CET, Julien Danjou <julien@danjou.info> :

>> Is there a way to enable certificate verification for Gnus? If not, is
>> there a way to force the old way to do TLS (by using an external
>> program)?
>
> This has been on my TODO list a year. There was a thread I launched on
> emacs-devel about that a year ago with Ted:
>
>   http://lists.gnu.org/archive/html/emacs-devel/2012-09/msg00154.html
>   http://lists.gnu.org/archive/html/emacs-devel/2012-12/msg00575.html
>
> I didn't have time to dig since then, but I'd appreciate any hint on
> this subject. :)

OK, I have just tested myself with:

#v+
(gnutls-negotiate
 :process (open-network-stream "test" nil "www.dailymotion.com" 443)
 :hostname "www.dailymotion.com"
 :verify-hostname-error t
 :verify-error t)
#v-

I don't know what "verify-error" is for since verify-hostname-error
seems to handle any error like certificate expired, mismatched name or
unknown root certificate. Example when the certificate is expired:

#v+
(gnutls-negotiate
 :process (open-network-stream "test" nil "www.pcwebshop.co.uk" 443)
 :hostname "www.pcwebshop.co.uk"
 :verify-hostname-error t
 :verify-error t)
#v-

It works for me. Now, if I understand correctly, you are also trying to
use `:trustfiles`. 

#v+
(gnutls-negotiate
 :process (open-network-stream "test" nil "awesome.naquadah.org" 443)
 :hostname "awesome.naquadah.org"
 :verify-hostname-error t
 :verify-error t)
#v-

I get an error. Now, I extract the certificate and specify it with
trustfiles option:

#v+
(gnutls-negotiate
 :process (open-network-stream "test" nil "awesome.naquadah.org" 443)
 :hostname "awesome.naquadah.org"
 :trustfiles '("/home/bernat/tmp/root.crt")
 :verify-hostname-error t
 :verify-error t)
#v-

And it works.

I am using Emacs 24.3 from Debian unstable. So far, it seems that the
builtin support is working.
-- 
printk("??? No FDIV bug? Lucky you...\n");
	2.2.16 /usr/src/linux/include/asm-i386/bugs.h