From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.devel Subject: Re: NSM certificate prompt Date: Sat, 13 Dec 2014 14:47:32 -0500 Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @ Cienfuegos Message-ID: <87r3w3z60b.fsf@lifelogs.com> References: <83a92r625n.fsf@gnu.org> <87wq5vefiz.fsf@gmx.de> <83388j5wrs.fsf@gnu.org> <87mw6reaxu.fsf@gmx.de> <83y4qb4eeg.fsf@gnu.org> <83vblf4b2p.fsf@gnu.org> Reply-To: emacs-devel@gnu.org NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1418500037 2826 80.91.229.3 (13 Dec 2014 19:47:17 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 13 Dec 2014 19:47:17 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sat Dec 13 20:47:10 2014 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1Xzsej-0005Rh-L5 for ged-emacs-devel@m.gmane.org; Sat, 13 Dec 2014 20:47:09 +0100 Original-Received: from localhost ([::1]:34129 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xzsej-00026K-A0 for ged-emacs-devel@m.gmane.org; Sat, 13 Dec 2014 14:47:09 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:34106) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xzsea-00026B-7e for emacs-devel@gnu.org; Sat, 13 Dec 2014 14:47:06 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XzseU-0000YL-9y for emacs-devel@gnu.org; Sat, 13 Dec 2014 14:47:00 -0500 Original-Received: from plane.gmane.org ([80.91.229.3]:49761) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XzseU-0000YG-2r for emacs-devel@gnu.org; Sat, 13 Dec 2014 14:46:54 -0500 Original-Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1XzseS-0004vX-PJ for emacs-devel@gnu.org; Sat, 13 Dec 2014 20:46:52 +0100 Original-Received: from c-98-229-61-72.hsd1.ma.comcast.net ([98.229.61.72]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 13 Dec 2014 20:46:52 +0100 Original-Received: from tzz by c-98-229-61-72.hsd1.ma.comcast.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 13 Dec 2014 20:46:52 +0100 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: emacs-devel@gnu.org Original-Lines: 24 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: c-98-229-61-72.hsd1.ma.comcast.net X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6; d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" Mail-Copies-To: never User-Agent: Gnus/5.130012 (Ma Gnus v0.12) Emacs/25.0.50 (gnu/linux) Cancel-Lock: sha1:g26PNKi2ErJasMIpkNQDaa+rO2A= X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.229.3 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:180034 Archived-At: On Sat, 13 Dec 2014 21:13:50 +0200 Eli Zaretskii wrote: EZ> Ha! It's very simple: we don't call the GnuTLS function that adds EZ> system's default trusted CAs to the data used for certificate EZ> verification. The simple patch below solves the problem for me. EZ> Any objections to installing this? Including on the branch? Ted? No problem for me, as long as it works. This function was not available back when we did the first cut of the GnuTLS integration. I'd make it the default, but through the trustfiles list: if the symbol 'system is found in the list, we load the system trust. And that's the default. But the user can add their own trustfiles, as they do now. EZ> What about Posix systems -- won't calling EZ> gnutls_certificate_set_x509_system_trust remove the need to load EZ> gnutls-trustfiles explicitly for every TLS connection? I think the user should be able to customize the trustfiles so the two are not exclusive. I don't know about once-per-connection either, is that a GnuTLS feature with gnutls_certificate_set_x509_system_trust()? Ted