Re: [PATCH RFC] GnuTLS: Support TOFU certificate checking.

[Eli Zaretskii]

> From: Lars Magne Ingebrigtsen <address@hidden>
> Cc: address@hidden,  address@hidden,  address@hidden
> Date: Wed, 08 Oct 2014 15:06:52 +0200
> 
> Eli Zaretskii <address@hidden> writes:
> 
> > How can it return a valid descriptor without all the validations it
> > does before that, which (AFAIU) you want to delegate to Lisp now?
> 
> It would validate the certificate, but never drop the connection even if
> the certificate is invalid.  It would be up to `open-network-stream' to
> close the connection if the user decides to not accept the invalid (or
> self-signed) certificate.

So you want to return a descriptor for a connection that failed
certificate validation, and let the application handle that?  That
could work, but I don't know what security-wary people here will tell
about keeping such connections.