Article delegate-en/4060 of [1-5169] on the server localhost:119
  upper oldest olders older1 this newer1 newers latest
search
[Top/Up] [oldest] - [Older+chunk] - [Newer+chunk] - [newest + Check]
[Reference:<_A4059@delegate-en.ML_>]
Newsgroups: mail-lists.delegate-en

[DeleGate-En] Re: How to verify a server's certificate?
11 Aug 2008 02:45:48 GMT feedback@delegate.org (Yutaka Sato)
The DeleGate Project


Hi Monika,

In message <_A4059@delegate-en.ML_> on 08/11/08(01:21:53)
you Monika Schilling <p3ehqbdyi-xtqvdm3cnljr.ml@ml.delegate.org> wrote:
 |This is because I want more than the answer "There is some CA certificate 
 |which verifies the certificate of the peer". In order to raise the security 
 |level my intension is to specify the CA certificate explicit and to ignore 
 |the bunch of preinstalled certificates in the system certs folder 
 |(/etc/ssl/certs) of the OpenSSL installation of my openSUSE Linux 
 |distribution completely.
...
 |OpenSSL Test Case for 2.
 |========================
 |  ms@r50e-ms:~/tmp/DeleGate> openssl verify -verbose -CApath emptyDir
 |    -CAfile vsign1.pem pop.1und1.de.pem

I implemented sslway.c of DeleGate to be compatible with the behavior of
"apps/s_client.c" of OpenSSL.  So if you test it with "openssl s_client"
rather than "openssl verify", you will see the same result with the one
of DeleGate.

 |I get a verification error. Obviously the system certs folder is still in
 |the CApath.
 |
 |Is this by intension? Touching the system certs folder is not an option for
 |me.

Maybe it is because sslway.c loades the default location of certificates
together with the explicitly specified certificates.
If it is the case, it can be disabled by removing the call to
"SSL_CTX_set_default_verify_paths(ctx)" from ssl_setCAs() in
filters/sslway.c.

Cheers,
Yutaka
--
  9 9   Yutaka Sato <y.sato@delegate.org> http://delegate.org/y.sato/
 ( ~ )  National Institute of Advanced Industrial Science and Technology
_<   >_ 1-1-4 Umezono, Tsukuba, Ibaraki, 305-8568 Japan
Do the more with the less -- B. Fuller

  admin search upper oldest olders older1 this newer1 newers latest
[Top/Up] [oldest] - [Older+chunk] - [Newer+chunk] - [newest + Check]
@_@V