Re: SSL Chains

On 12 Apr 2011, at 03:43, Kevin Goodsell wrote:
On Sat, Apr 9, 2011 at 10:36 PM, Sabahattin Gucukoglu
> <[email protected]> wrote:
>> I'm still experiencing delays caused by verification using the
>> issuer's intermediate certificate, using a referral to the
>> intermediate's web servers whenever I submit a message using
>> tmda-ofmipd for the first time in each session of my MUA (tmda-fork
>> version).  Is there any way to fix this, by having the entire chain
>> sent to the client, without going through stunnel?
> 
> Sabahattin, it looks like the solution to this is as easy as making a
> simple change to one line in tmda-ofmipd from this:
> 
>    ssl_context.use_certificate_file(os.path.expanduser(opts.ssl_cert))
> 
> To this:
> 
>    ssl_context.use_certificate_chain_file(os.path.expanduser(opts.ssl_cert))
> 
> That is, adding "_chain". You might want to try making this change on
> your system and see if it fixes your problem. The chain file just
> replaces the usual certificate file in the --ssl-cert option. The format
> must be PEM, of course.

Wonderful!  Everything's good now, return code 0 for straight verification, and fast.  Thanks!  Please make it the default input file format for tmda-ofmipd, it is after all compatible with the older use.

> My understanding of this certificate chain thing is not great, but I've
> tested this and it seems to work. The --help output and man page just
> need to be updated before it will be ready to be checked in.

That change would seem to be the same as the difference between C-interface OpenSSL calls, with one selecting PEM-type as a parameter and another selecting only a chain of PEM-type certificates (there is no such thing as a DER-encoded chain).  For details see SSL_CTX_use_certificate_chain_file(3ssl).

Cheers,
Sabahattin

------------------------------------------------------------------------------
Forrester Wave Report - Recovery time is now measured in hours and minutes
not days. Key insights are discussed in the 2010 Forrester Wave Report as
part of an in-depth evaluation of disaster recovery service providers.
Forrester found the best-in-class provider in terms of services and vision.
Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
_______________________________________________
tmda-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tmda-users