Re: Builtin GnuTLS support and certificate verification

[Ted Zlatanov <tzz@lifelogs.com>]

On Mon, 04 Nov 2013 20:54:26 +0100 Vincent Bernat <bernat@luffy.cx> wrote: 

VB> I agree with you but I find odd to have two verification algorithms. I
VB> don't see the point of verifying the hostname if the certificate is
VB> invalid on some other points and I don't see the point of not verifying
VB> the hostname.

IIRC, the hostname is an optional part of a certificate and certificates
are not the only form of authentication.  So there are two cases (verify
connection and verify certificate hostname).

VB> I mean, if you accept any valid certificate, it is trivial for me to
VB> present you with the certificate of my website. If you accept any
VB> invalid certificate with the right hostname, it is also trivial for me
VB> to build a self-signed certificate with the right hostname.

I think verifying the hostname is a subset of verifying the remote in
general.  I just didn't express it well.

VB> So, for me, there should be only one verification algorithm. We are not
VB> in the ideal case for this because we only have one algorithm but its
VB> name does not exactly describe it.

VB> Maybe you could just alias verify-error and verify-hostname-error and
VB> say in the documentation that they do the same and that
VB> verify-hostname-error will be removed at some point?

I think :verify-error should be a list; when it contains 'x509-hostname
then we behave like :verify-hostname-error does now, for backwards
compatibility.  But otherwise we'll add extra checks to the list, not as
top-level options to `gnutls-boot'.  It's easy to put a Customize
interface on top of that.

Ted