Re: url library and GnuTLS, and Emacs-issued certificates

[Lars Magne Ingebrigtsen]

Chong Yidong <address@hidden> writes:

> Could you explain in more detail?

tls.el is quite simple.  You start openssl/gnutls-cli as a subprocess
with the correct parameters, parse the output slightly, and then talk
over the socket.

starttls.el is a bit different.  You call `open-starttls-stream', which
starts gnutls-cli in unencrypted mode.  Then you do protocol-specific
things to see whether the server supports STARTTLS.  If it does, you
issue the commands necessary for the server to start talking TLS.  You
then call `startls-negotiate' which sends a signal to gnutls-cli which
makes gnutls-cli go to encrypted mode, parses the output from
gnutls-cli, and returns the status of the now-encrypted socket.

To make things even more confusing, openssl does have support for
STARTTLS, too, but you then have to let openssl itself do the STARTTLS
negotiation by telling openssl what protocol it's talking.  And it
doesn't support all the protocols that Emacs needs, so it can't really
be used.

-- 
(domestic pets only, the antidote for overdose, milk.)
  address@hidden * Lars Magne Ingebrigtsen