taskWeeChat - Tasks: task #12724, expected SSL-Certificate

 
 

task #12724: expected SSL-Certificate

Submitter:  Roland <roidal>
Submitted:  Sun 30 Jun 2013 12:59:31 PM UTC
   
 
Category:  irc plugin Should Start On:  Sun 30 Jun 2013 12:00:00 AM UTC
Should be Finished on:  Sun 30 Jun 2013 12:00:00 AM UTC Priority:  * 5 - Normal
Status:  Done Privacy:  Public
Assigned to:  flashcode Percent Complete:  100%
Originator Name:  Open/Closed:  Closed
Planned Release:  0.4.3 IRC nick:  roidal
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 21 Jan 2014 11:35:34 AM UTC, comment #4: 

Committed, thanks for the patch.

And I refactorized the gnutls callback to display certificates, even if the new server option "ssl_fingerprint" is set.

Sebastien Helleu <flashcode>
Group administrator
Mon 20 Jan 2014 12:07:33 PM UTC, comment #3: 

Task 12293 is also related. It proposes an alternative method to accept certificates.

Task #11357 is also related. It requests a per-network root CA list. But with this option, it does become less important. It seems to me that if you're going to set a network specific CA, you might as well just specify exactly which certificate to accept. But I might be wrong.

Maarten de Vries <de_vri_es>
Mon 20 Jan 2014 11:58:39 AM UTC, comment #2: 

Uploaded a patch that adds a 'ssl_fingerprint' option for servers. When non-empty, the normal checks are disabled and the certificate fingerprint must match the set sha1 fingerprint. It should be given as hexadecimal string withouth seperators between the bytes. That's also what weechat shows when it rejects the certificate.

We could still maybe add a message when the certificate is rejected that the user can accept it by setting this option.

I thought this was easier than the gnutls builtin trusted keystore, since it can be managed from weechat with simple set/unset commands.

This is my first patch for weechat, so I hope it's good enough :)

Maarten de Vries <de_vri_es>
Mon 20 Jan 2014 07:55:54 AM UTC, comment #1: 

By the way there is also a GnuTLS feature which directly implements something very similar to this, called TOFU (Trust On First Use): http://www.gnutls.org/manual/html_node/Verifying-a-certificate-using-trust-on-first-use-authentication.html#Verifying-a-certificate-using-trust-on-first-use-authentication

Anonymous
Sun 30 Jun 2013 12:59:31 PM UTC, original submission:  

Options for the sha1 fingerprint and/or the path to the expected ssl-certificate for a connection.

Roland <roidal>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #30317:  0001-irc-add-option-to-accept-server-certificate-with-fin.patch added by de_vri_es (10KiB - text/x-patch - This patch adds a 'ssl_fingerprint' option for servers. When non-empty, the normal checks are disabled and the certificate fingerprint must match the set sha1 fingerprint. It should be given as hexadecimal string withouth seperators between the bytes.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by flashcode (Posted a comment)
  • -email is unavailable- added by de_vri_es (Updated the item)
  • -email is unavailable- added by roidal (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-09 flashcode Open/ClosedOpen Closed
    2014-01-21 flashcode CategoryNone irc plugin
        StatusNone Done
        Percent Complete0% 100%
        Assigned toNone flashcode
        Planned ReleaseNone 0.4.3
    2014-01-20 de_vri_es Attached File- Added 0001-irc-add-option-to-accept-server-certificate-with-fin.patch, #30317

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code