Re: SHA256 fingerprints

--001a1136019686d263050784449a
Content-Type: text/plain; charset=UTF-8

Hey,

Note that I'm no irssi developer, just curious about this since I have
implemented it in my own client a long time ago.

Wouldn't it be better to use an implementation independent name like
ssl_fingerprint?

Thanks,

On Mon, Nov 10, 2014 at 11:45 AM, <[email protected]> wrote:

> These 4 patches i just sent there implement SHA256 fingerprint option
> "ssl_sha256".  It can be used to implement "trust on first use" policy
> for self-signed certificates for servers that don't provide full
> certificate chain. When it is impossible to retrieve CA certificate, you
> can still trust the certificate itself by its fingerprint.
>
> Fingerprint is checked only if ssl_sha256 option is present in the
> config file. Other options, such as ssl_verify, are not affected.
> Connection is established only if all requested checks pass.
>
> weechat has similar option called "ssl_fingerprint"
>
>

--001a1136019686d263050784449a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div><div>Hey,<br><br></div></div></div>Note tha=
t I&#39;m no irssi developer, just curious about this since I have implemen=
ted it in my own client a long time ago.<br><br></div><div>Wouldn&#39;t it =
be better to use an implementation independent name like ssl_fingerprint?<b=
r></div><div><br></div>Thanks,<br></div><div class=3D"gmail_extra"><br><div=
 class=3D"gmail_quote">On Mon, Nov 10, 2014 at 11:45 AM,  <span dir=3D"ltr"=
>&lt;<a href=3D"mailto:[email protected]" target=3D"_blank">noname@inven=
tati.org</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">These 4 =
patches i just sent there implement SHA256 fingerprint option<br>
&quot;ssl_sha256&quot;.=C2=A0 It can be used to implement &quot;trust on fi=
rst use&quot; policy<br>
for self-signed certificates for servers that don&#39;t provide full<br>
certificate chain. When it is impossible to retrieve CA certificate, you<br=
>
can still trust the certificate itself by its fingerprint.<br>
<br>
Fingerprint is checked only if ssl_sha256 option is present in the<br>
config file. Other options, such as ssl_verify, are not affected.<br>
Connection is established only if all requested checks pass.<br>
<br>
weechat has similar option called &quot;ssl_fingerprint&quot;<br>
<br>
</blockquote></div><br></div>

--001a1136019686d263050784449a--