Re: Built-in TLS vs. nnimap security

[Lars Magne Ingebrigtsen <larsi@gnus.org>]

Romain Francoise <romain@orebokech.com> writes:

> Is it a feature or a bug that when the built-in GnuTLS support is loaded
> in Emacs, nnimap happily connects to my test imaps server even though the
> certificate is self-signed and doesn't match the hostname?

It's a ... er ... missing feature.  :-)

> Actually, shouldn't `open-gnutls-stream' do these checks by default
> anyway? It's a new implementation, it doesn't have to follow the (poor)
> historical defaults set by tls.el.

Yes, it's meant to do that, but nobody has actually implemented the
needed callbacks, I seem to remember?  Or did Ted do that, and I missed
it?  I was going to do the `open-network-stream' querying thing after
the required callbacks were in place.  The last thing I seem to vaguely
recall was Ted saying something about different verification callback
structures in different versions of the gnutls libraries, which made
things awkward.

But I may be misremembering.  Anybody?  :-)

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/