taskWeeChat - Tasks: task #12724, expected SSL-Certificate

 
 

task #12724: expected SSL-Certificate

Submitted by:  Roland <roidal>
Submitted on:  Sun 30 Jun 2013 12:59:31 PM UTC  
 
Category: irc pluginShould Start On: Sun 30 Jun 2013 12:00:00 AM UTC
Should be Finished on: Sun 30 Jun 2013 12:00:00 AM UTCPriority: 5 - Normal
Status: DonePrivacy: Public
Percent Complete: 100%Assigned to: Sebastien Helleu <flashcode>
Originator Name: Open/Closed: Closed
Planned Release: 0.4.3IRC nick: roidal

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 21 Jan 2014 11:35:34 AM UTC, comment #4:

Committed, thanks for the patch.

And I refactorized the gnutls callback to display certificates, even if the new server option "ssl_fingerprint" is set.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Mon 20 Jan 2014 12:07:33 PM UTC, comment #3:

Task 12293 is also related. It proposes an alternative method to accept certificates.

Task #11357 is also related. It requests a per-network root CA list. But with this option, it does become less important. It seems to me that if you're going to set a network specific CA, you might as well just specify exactly which certificate to accept. But I might be wrong.

Maarten de Vries <de_vri_es>
Mon 20 Jan 2014 11:58:39 AM UTC, comment #2:

Uploaded a patch that adds a 'ssl_fingerprint' option for servers. When non-empty, the normal checks are disabled and the certificate fingerprint must match the set sha1 fingerprint. It should be given as hexadecimal string withouth seperators between the bytes. That's also what weechat shows when it rejects the certificate.

We could still maybe add a message when the certificate is rejected that the user can accept it by setting this option.

I thought this was easier than the gnutls builtin trusted keystore, since it can be managed from weechat with simple set/unset commands.

This is my first patch for weechat, so I hope it's good enough :)

Maarten de Vries <de_vri_es>
Mon 20 Jan 2014 07:55:54 AM UTC, comment #1:

By the way there is also a GnuTLS feature which directly implements something very similar to this, called TOFU (Trust On First Use): http://www.gnutls.org/manual/html_node/Verifying-a-certificate-using-trust-on-first-use-authentication.html#Verifying-a-certificate-using-trust-on-first-use-authentication

Anonymous
Sun 30 Jun 2013 12:59:31 PM UTC, original submission:

Options for the sha1 fingerprint and/or the path to the expected ssl-certificate for a connection.

Roland <roidal>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #30317:  0001-irc-add-option-to-accept-server-certificate-with-fin.patch added by de_vri_es (10kB - text/x-patch - This patch adds a 'ssl_fingerprint' option for servers. When non-empty, the normal checks are disabled and the certificate fingerprint must match the set sha1 fingerprint. It should be given as hexadecimal string withouth seperators between the bytes.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by flashcode (Posted a comment)
  • -unavailable- added by de_vri_es (Updated the item)
  • -unavailable- added by roidal (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 09 Feb 2014 09:48:48 AM UTCflashcodeOpen/ClosedOpen=>Closed
    Tue 21 Jan 2014 11:35:34 AM UTCflashcodeCategoryNone=>irc plugin
      StatusNone=>Done
      Percent Complete0%=>100%
      Assigned toNone=>flashcode
      Planned ReleaseNone=>0.4.3
    Mon 20 Jan 2014 11:53:44 AM UTCde_vri_esAttached File-=>Added 0001-irc-add-option-to-accept-server-certificate-with-fin.patch, #30317

    Back to the top


    Powered by Savane 3.1-cleanup