Re: nntp server news.gmane.org tries to use gnutls

[Steinar Bang <sb@dod.no>]

>>>>> asjo@koldfront.dk (Adam Sjøgren):

> To me it sounds like a feature - default to the most reasonable thing
> to do.

Yes, but that's what I was unsure about: is gunning for STARTTLS always
the most reasonable thing to do...?

> It sounds like a bug if it doesn't work, though.

Indeed.

> I don't think I have done anything like that to make it work - I may
> be misremembering though. Looks like I just have (require 'gnutls) and
> that's it.

I tried Katsumi Yamaoka's workaround, but that didn't work for me.  I
just got
 Opening nntp server on news.gmane.org...done
 apply: Server closed connection

Since then it has sometimes worked and sometimes not.  Entering
gmane.discuss worked, but entering this group immediately after,
failed. 

So now I tried upping the GNUTls log level in Messages, by doing
 (setq gnutls-log-level 1)
in the scratch buffer.

And then entering this group worked without a hitch... but I don't know
if this was coincidental or an actual effect.  Have the gmane servers
had some issues today, I wonder...?

This is what the increased log level said:
 Opening nntp server on news.gmane.org...
 gnutls.c: [1] (Emacs) allocating credentials
 gnutls.c: [1] (Emacs) gnutls callbacks
 gnutls.c: [1] (Emacs) gnutls_init
 gnutls.c: [1] (Emacs) got non-default priority string: NORMAL
 gnutls.c: [1] (Emacs) setting the priority string
 news.gmane.org certificate could not be verified.
 gnutls.c: [1] (Emacs) certificate signer was not found: news.gmane.org
 gnutls.c: [1] (Emacs) certificate validation failed: news.gmane.org
 Opening nntp server on news.gmane.org...done

(certificate validation failed, but that did not stop Gnus from
continuing)

>> (BTW it would be nice if the gmane.org certs were signed by cacert
>> instead of being self-signed)

> They just have to be updated quite often, which is a {b,ch}ore.

Possible solutions:
 - Automate the server certificate updates (once every 3 months)
   http://wiki.cacert.org/Software/CertApi
 - Someone (ie. Lars) should get a higher level of trust with cacert.org
   and get longer-lived certs
 - Both of the above

(I think I will try for the automated solution for my own certs)