Re: tls-program

[David Engster <deng@randomsample.de>]

Lars Magne Ingebrigtsen writes:
> Steinar Bang <sb@dod.no> writes:
>
>> So they are the typical case for someone with a private dovecot imap
>> server, running on a debian box somewhere.
>
> Yes, that's what I would have imagined.

gnutls-cli accepts self-signed certificates by default:

- The hostname in the certificate matches 'mydomain.foobar'.
- Peer's certificate issuer is unknown
- Peer's certificate is NOT trusted

but it continues anyway. I think it only balks when you explicitly
specify your trusted CAs through --x509cafile or something similar. If
you specify your trusted CAs, it seems you can set tls-checktrust to
'ask and get a similar behavior like Thunderbird's et al.

However, a hostname mismatch is not tolerated, and can only be
overridden with --insecure. This shouldn't be the default,
though. Openssl indeed always continues by default, but I think a
hostname mismatch should at least be warned about.

-David