Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

[9fans] certificates and tlssrv

0 views
Skip to first unread message

Brantley Coile

unread,
Mar 30, 2004, 6:52:52 PM3/30/04
to
I'm running a custom https server and I'm using
tlssrv to setup the session. How do I specify
all the certificates to show the client that I'm
in a known chain of certificates? I have
three certificates that chain all the way back
to someone all the browers trust, but it appears
that tlssrv is only telling them about the first one.

Brantley

David Presotto

unread,
Mar 30, 2004, 8:45:00 PM3/30/04
to
We don't follow chains, we just believe any x.509 fingerprints we
have.

Is that what you are asking?

Geoff Collyer

unread,
Mar 30, 2004, 8:49:52 PM3/30/04
to
I think he wants to have tlssrv present multiple certificates to
clients, so that they can follow the chain back to the root.

Brantley Coile

unread,
Mar 31, 2004, 8:22:53 AM3/31/04
to
> I think he wants to have tlssrv present multiple certificates to
> clients, so that they can follow the chain back to the root.

I should know better than to compose a 9fans request at 8pm!

Geoff is correct. I want web browsers not to complain about the
certificate I give them. I have a chain we bought from somewhere.
Under openSSL (don't get me started : ) I put them all into a single
file that was loaded. The readcert(2) seems to stop after reading a
single cert. Should I hack it to catenate them togeter and set the
TLSconn->cert to that whole thing?

Thanks
Brantley

boyd, rounin

unread,
Apr 1, 2004, 9:56:21 AM4/1/04
to
> We don't follow chains, we just believe any x.509 fingerprints we
> have.

good call. the PKI is a disaster and a monopoly.

0 new messages