Re: What level to put STARTTLS certificates

[Ted Zlatanov <tzz@lifelogs.com>]

On Wed, 15 Jun 2011 20:29:28 +0200 Lars Magne Ingebrigtsen <larsi@gnus.org> wrote: 

LMI> ;;(setq smtpmail-starttls-credentials
LMI> ;;      '(("YOUR SMTP HOST" 25 "~/.my_smtp_tls.key" "~/.my_smtp_tls.cert")))

LMI> But it strikes me that this is probably on the totally wrong level.  I
LMI> mean, any TLS connection can have user keys/certs connected to them, so
LMI> it seems to me that the right level to control this is on the
LMI> network-stream.el level, and not on the
LMI> smtpmail.el/pop3.el/nntp.el/imap.el level.

LMI> So I think I'll get rid of that variable, and put this stuff into
LMI> network-stream.el instead.

Cool.

LMI> I'm thinking the right place to stash this is in ~/.authinfo, since
LMI> these are credentials.  The format will be

LMI> machine smtp.gmail.com port 587 tls-key file:~/.my_smtp_tls.key tls-cert file:~/.my_smtp_tls.cert

LMI> Any objections?

Why do you need a file: prefix?  It should only work with local files
(we pass the file names in `gnutls-boot' to GnuTLS with
`gnutls_certificate_set_x509_key_file' so remote files can't work).  We
could support inlined certificates I guess, but it seems like it's
better to assume the token is a file name and extend it later.  It's by
far the most common case and the only one gnutls.c supports right now.

Looks good otherwise.

Ted