From: Reiner Steib <reinersteib+gmane@imap.cc>
To: Elias Oltmanns <eo@nebensachen.de>
Cc: Simon Josefsson <jas@extundo.com>, ding@gnus.org, emacs-devel@gnu.org
Subject: Re: [Patch] Make tls.el support certificate verification
Date: Sun, 25 Nov 2007 15:18:31 +0100 [thread overview]
Message-ID: <v9oddi1k94.fsf@marauder.physik.uni-ulm.de> (raw)
In-Reply-To: <87r6iff9hf.fsf@denkblock.local> (Elias Oltmanns's message of "Sun, 25 Nov 2007 01:35:08 +0100")
On Sun, Nov 25 2007, Elias Oltmanns wrote:
> Reiner Steib <reinersteib+gmane@imap.cc> wrote:
>> See http://article.gmane.org/gmane.emacs.gnus.commits/5529 for my
>> cosmetic/style changes.
>
> Unfortunately, this link seems to be a dead end.
The web interface has some problems at the moment. I'm sure it will
work again soon (i.e. when Lars fixes the problem).
In Gnus you may use these
<nntp://news.gmane.org/gmane.emacs.gnus.commits/5529>,
<news:E1Iw2Sy-0003hx-00@quimby.gnus.org>
(cf. `gnus-refer-article-method').
>> Would it be useful to add the strings suggested in the doc string of
>> `tls-checktrust' to `tls-program'? Or provide them as custom options
>> for `tls-program'?
>
> Well, I wasn't quite sure about it at the time and I'm not any wiser
> yet. I'm using the examples given in the doc string in a Debian
> environment but they need not work properly for other distributions or
> OSes.
On openSUSE, I have the directory, but no file ca-certificates.crt:
$ cat /etc/SuSE-release
openSUSE 10.2 (i586)
VERSION = 10.2
$ ls -F /etc/ssl/certs/
1e49180d.0@ 843b6c51.0@ d4e39186.0@ Equifax-root1.pem vsign1.pem
2edf7016.0@ 878cf4c6.0@ ddc328ff.0@ expired/ vsign3.pem
56e607f4.0@ a3c60019.0@ demo/ f73e89fd.0@ vsignss.pem
594f1775.0@ aad3d04d.0@ eng1.pem ICP-Brasil.pem wellsfgo.pem
6adf0799.0@ argena.pem eng2.pem RegTP-5R.pem
6f5d9899.0@ argeng.pem eng3.pem RegTP-6R.pem
7651b327.0@ c33a80d4.0@ eng4.pem thawteCb.pem
7a9820c1.0@ cdd7aee7.0@ eng5.pem thawteCp.pem
> In fact, I think it is so hard to come up with sensible default
> values that are actually worth making the effort that the best GNU
> developers can do is to provide the facilities and sufficient
> documentation to make use of them. Distributors may or may not
> tweak the default settings and give further advice to their users
> but even they shouldn't enable tls-checktrust by default as this
> really should be a decision consciously taken by the end user.
I think it makes sense to add them as customize choices (committed to
Gnus trunk):
;; FIXME: add brief `:tag "..."' descriptions.
;; See `tls-checktrust':
(const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h")
(const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h --protocols ssl3")
(const "openssl s_client -connect %h:%p -CAfile /etc/ssl/certs/ca-certificates.crt -no_ssl2")
;; No trust check:
(const "gnutls-cli -p %p %h")
(const "gnutls-cli -p %p %h --protocols ssl3")
(const "openssl s_client -connect %h:%p -no_ssl2"))
Is this the right order? Would someone like to add brief `:tag "..."'
descriptions for each entry?
> After all, the mail server needn't have a certificate signed by one
> of the well known CAs and may still be valid. Besides, users might
> want to specify the set of trusted root certificates depending on
> the server emacs is connecting to. All this seems to make proper
> documentation more important than presetting any defaults. Do you
> think the provided doc strings can serve this purpose or should I
> squeeze in a few sentences somewhere else?
As tls.el is not specific to Gnus (it is in lisp/net in Emacs 22), it
should probably not be documented in gnus.texi, maybe in
smtpmail.texi, e.g. (info "(smtpmail)Authentication").
If there's no suitable manual, probably the best places are the doc
strings of `tls-program' and/or `tls-checktrust'.
Simon, any suggestion? Opinions?
Bye, Reiner.
--
,,,
(o o)
---ooO-(_)-Ooo--- | PGP key available | http://rsteib.home.pages.de/
next prev parent reply other threads:[~2007-11-25 14:18 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-09-16 23:08 Elias Oltmanns
2007-09-24 7:12 ` Simon Josefsson
2007-09-24 16:27 ` Reiner Steib
2007-09-25 14:42 ` Simon Josefsson
2007-11-08 18:44 ` Elias Oltmanns
2007-11-08 19:52 ` Reiner Steib
2007-11-16 17:22 ` Elias Oltmanns
2007-11-16 22:38 ` Reiner Steib
2007-11-16 23:07 ` Elias Oltmanns
2007-11-24 21:31 ` Reiner Steib
2007-11-25 0:35 ` Elias Oltmanns
2007-11-25 14:18 ` Reiner Steib [this message]
2007-11-26 14:47 ` Simon Josefsson
2007-11-27 11:10 ` Elias Oltmanns
2007-11-28 22:05 ` Reiner Steib
2007-11-28 22:08 ` Coding conventions (was: [Patch] Make tls.el support certificate verification) Reiner Steib
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=v9oddi1k94.fsf@marauder.physik.uni-ulm.de \
--to=reinersteib+gmane@imap.cc \
--cc=Reiner.Steib@gmx.de \
--cc=ding@gnus.org \
--cc=emacs-devel@gnu.org \
--cc=eo@nebensachen.de \
--cc=jas@extundo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).