Re: [Patch] Make tls.el support certificate verification

[Reiner Steib]

On Sun, Nov 25 2007, Elias Oltmanns wrote:

> Reiner Steib <address@hidden> wrote:
>> See http://article.gmane.org/gmane.emacs.gnus.commits/5529 for my
>> cosmetic/style changes.
>
> Unfortunately, this link seems to be a dead end.

The web interface has some problems at the moment.  I'm sure it will
work again soon (i.e. when Lars fixes the problem).

In Gnus you may use these
<nntp://news.gmane.org/gmane.emacs.gnus.commits/5529>,
<news:address@hidden>
(cf. `gnus-refer-article-method').

>> Would it be useful to add the strings suggested in the doc string of
>> `tls-checktrust' to `tls-program'?  Or provide them as custom options
>> for `tls-program'?
>
> Well, I wasn't quite sure about it at the time and I'm not any wiser
> yet.  I'm using the examples given in the doc string in a Debian
> environment but they need not work properly for other distributions or
> OSes.  

On openSUSE, I have the directory, but no file ca-certificates.crt:

$ cat /etc/SuSE-release 
openSUSE 10.2 (i586)
VERSION = 10.2
$ ls -F /etc/ssl/certs/
1e49180d.0@  843b6c51.0@  d4e39186.0@  Equifax-root1.pem  vsign1.pem
2edf7016.0@  878cf4c6.0@  ddc328ff.0@  expired/           vsign3.pem
56e607f4.0@  a3c60019.0@  demo/        f73e89fd.0@        vsignss.pem
594f1775.0@  aad3d04d.0@  eng1.pem     ICP-Brasil.pem     wellsfgo.pem
6adf0799.0@  argena.pem   eng2.pem     RegTP-5R.pem
6f5d9899.0@  argeng.pem   eng3.pem     RegTP-6R.pem
7651b327.0@  c33a80d4.0@  eng4.pem     thawteCb.pem
7a9820c1.0@  cdd7aee7.0@  eng5.pem     thawteCp.pem

> In fact, I think it is so hard to come up with sensible default
> values that are actually worth making the effort that the best GNU
> developers can do is to provide the facilities and sufficient
> documentation to make use of them.  Distributors may or may not
> tweak the default settings and give further advice to their users
> but even they shouldn't enable tls-checktrust by default as this
> really should be a decision consciously taken by the end user.

I think it makes sense to add them as customize choices (committed to
Gnus trunk):

          ;; FIXME: add brief `:tag "..."' descriptions.
          ;; See `tls-checktrust':
          (const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p 
%p %h")
          (const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p 
%p %h --protocols ssl3")
          (const "openssl s_client -connect %h:%p -CAfile 
/etc/ssl/certs/ca-certificates.crt -no_ssl2")
          ;; No trust check:
          (const "gnutls-cli -p %p %h")
          (const "gnutls-cli -p %p %h --protocols ssl3")
          (const "openssl s_client -connect %h:%p -no_ssl2"))

Is this the right order?  Would someone like to add brief `:tag "..."'
descriptions for each entry?

> After all, the mail server needn't have a certificate signed by one
> of the well known CAs and may still be valid.  Besides, users might
> want to specify the set of trusted root certificates depending on
> the server emacs is connecting to.  All this seems to make proper
> documentation more important than presetting any defaults.  Do you
> think the provided doc strings can serve this purpose or should I
> squeeze in a few sentences somewhere else?

As tls.el is not specific to Gnus (it is in lisp/net in Emacs 22), it
should probably not be documented in gnus.texi, maybe in
smtpmail.texi, e.g. (info "(smtpmail)Authentication").

If there's no suitable manual, probably the best places are the doc
strings of `tls-program' and/or `tls-checktrust'.

Simon, any suggestion?  Opinions?

Bye, Reiner.
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/