Re: NSM certificate prompt

[Ted Zlatanov <tzz@lifelogs.com>]

On Sat, 13 Dec 2014 21:13:50 +0200 Eli Zaretskii <eliz@gnu.org> wrote: 

EZ> Ha!  It's very simple: we don't call the GnuTLS function that adds
EZ> system's default trusted CAs to the data used for certificate
EZ> verification.  The simple patch below solves the problem for me.

EZ> Any objections to installing this?  Including on the branch?  Ted?

No problem for me, as long as it works.  This function was not available
back when we did the first cut of the GnuTLS integration.

I'd make it the default, but through the trustfiles list: if the symbol
'system is found in the list, we load the system trust. And that's the
default.  But the user can add their own trustfiles, as they do now.

EZ> What about Posix systems -- won't calling
EZ> gnutls_certificate_set_x509_system_trust remove the need to load
EZ> gnutls-trustfiles explicitly for every TLS connection?

I think the user should be able to customize the trustfiles so the two
are not exclusive.  I don't know about once-per-connection either, is
that a GnuTLS feature with gnutls_certificate_set_x509_system_trust()?

Ted