Re: SSL Chains

On Sat, Apr 9, 2011 at 10:36 PM, Sabahattin Gucukoglu
<[email protected]> wrote:
> I'm still experiencing delays caused by verification using the
> issuer's intermediate certificate, using a referral to the
> intermediate's web servers whenever I submit a message using
> tmda-ofmipd for the first time in each session of my MUA (tmda-fork
> version). =A0Is there any way to fix this, by having the entire chain
> sent to the client, without going through stunnel?
>

Sabahattin, it looks like the solution to this is as easy as making a
simple change to one line in tmda-ofmipd from this:

    ssl_context.use_certificate_file(os.path.expanduser(opts.ssl_cert))

To this:

    ssl_context.use_certificate_chain_file(os.path.expanduser(opts.ssl_cert=
))

That is, adding "_chain". You might want to try making this change on
your system and see if it fixes your problem. The chain file just
replaces the usual certificate file in the --ssl-cert option. The format
must be PEM, of course.

My understanding of this certificate chain thing is not great, but I've
tested this and it seems to work. The --help output and man page just
need to be updated before it will be ready to be checked in.

-Kevin

---------------------------------------------------------------------------=
---
Forrester Wave Report - Recovery time is now measured in hours and minutes
not days. Key insights are discussed in the 2010 Forrester Wave Report as
part of an in-depth evaluation of disaster recovery service providers.
Forrester found the best-in-class provider in terms of services and vision.
Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
_______________________________________________
tmda-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tmda-users