Changes between Version 51 and Version 52 of CertMgr

Timestamp:

Jun 22, 2007, 11:34:48 PM (17 years ago)

Author:

wehlhard

Comment:

yay for writing

CertMgr

@@ -31 +31 @@
  2. If the hostname check fails, ssl_connect will prompt the user with the certificate data and a warning that the hostname check failed.
  3. If the user accepts the certificate anyways, ssl_connect calls bless_certificate in the tls_peers CertificateVerifier, which adds it to the "tls_peers" pool. The connection initialization is then completed. (The exact action at this step is not really laid in stone, though)
+
+== A better-written example ==
+SSL SYSTEM:
+ 1. Set up connection with gmail.com.
+ 2. Fetch peer certificate chain.
+ 3. Pass peer certificate chain to the Verifier, along with a callback that accepts an "approved? yes or no" value.
+
+VERIFIER:
+ 4. See if the first cert in the chain is in some .ssh/known_hosts equivalent. If it is, trigger the callback with "approved"
+ 5. See if the certificate chain is valid against a known CA. If it is, trigger the callback with "approved"
+ 6. Prompt the user with details for approval. If the user approves, trigger the callback with "approved"
+ 7. Trigger the callback with "not approved"
+
+SSL SYSTEM (via callback):
+ 8. If the certificate chain was approved, finish connection setup. If it wasn't, abort the connection with an informative error message.
 
 == CertificateScheme API  ==