Re: CA validation

Hi

You replied on the imapproxy patch, but not on the squirrelmail one. Was
it committed, or is there something to improve?

Emmanuel Dreyfus <[email protected]> wrote:

> > Indeed. If you care to send a diff, I'd be happy to commit it.
> 
> Here is it:
> http://ftp.espci.fr/shadow/manu/sq-stream.patch
> 
> I tested it with this configuration:
>         $smtpServerAddress='smtp.example.net';
>       $smtpPort = 465;
>         $use_smtp_tls = true;
>         $smtpOptions['ssl']['verify_peer'] = true;
>         $smtpOptions['ssl']['verify_depth'] = 3;
>         $smtpOptions['ssl']['cafile'] = '/etc/openssl/certs/ca.crt';
> 
> Using the wrong CA in $smtpOptions['ssl']['cafile'] cause the connexion
> to abort, which suggests the thing works. Sendmail logs the TLS cipher
> used as being ECDHE-RSA-AES256-GCM-SHA384, which is the best OpenSSL
> can do.
> 
> There is just one small problem, with default timeout: having a
> null timeout cause CA validation to always fail. In that patch, 
> I change a null tuimeout to abitrary value 30, but perhaps that
> should be configurable.


-- 
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
[email protected]

------------------------------------------------------------------------------
CenturyLink Cloud: The Leader in Enterprise Cloud Services.
Learn Why More Businesses Are Choosing CenturyLink Cloud For
Critical Workloads, Development Environments & Everything In Between.
Get a Quote or Start a Free Trial Today. 
http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel