From: Thomas Roessler <roessler@does-not-exist.org>
Date: Sun, 28 May 2000 20:28:52 +0000 (+0000)
Subject: SSL certificate verification fixes from Tommi Komulainen.
X-Git-Tag: mutt-1-3-3-rel~18
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bf0abf24a798c83afd0fed227f8cb418ad6a1a7e;p=mutt

SSL certificate verification fixes from Tommi Komulainen.
---

diff --git a/README.SSL b/README.SSL
index 1cdceab4..95a11a8a 100644
--- a/README.SSL
+++ b/README.SSL
@@ -41,16 +41,33 @@ $EGDSOCKET (if this environment variable is set), ~/.entropy and
 described above.
 
 
+Certificates
+------------
 Each time a server is contacted, its certificate is checked against
 known valid certificates. When an unknown certificate is encountered,
 you are asked to verify it. If you reject the certificate, the
 connection will be terminated immediately. If you accept the
-certificate, the connection will be established. If you accept the
-certificate, you can also save it so that further connections to the
-server are automatically accepted. Certificates will be saved in the
-file specified by $certificate_file variable. It is empty as default,
-so if you don't want to verify certificates each time you connect to a
-server, you have set this variable to some reasonable value.
+certificate, the connection will be established. Accepted certificates
+can also be saved so that further connections to the server are
+automatically accepted. 
+
+If your organization has several equivalent IMAP-servers, each of them
+should have a unique certificate which is signed with a common
+certificate.  If you want to use all of those servers, you don't need to
+save each server certificate on the first connect.  Instead, you can get
+the signer certificate and save it instead.  That way, mutt will
+automatically accept all certificates signed with the saved certificate.
+
+System-wide certificates are by default considered trusted when checking
+certificates by signer.  This allows system administrators to setup
+trusted certificates for all users.  How to install certificates
+system-wide, depends on the OpenSSL installation.  Use of system-wide
+certificates can be disabled by unsetting $ssl_usesystemcerts variable.
+
+Certificates will be saved in the file specified by $certificate_file
+variable.  It is empty as default, so if you don't want to verify
+certificates each time you connect to a server, you have set this
+variable to some reasonable value.
 
 For example:
 	set certificate_file=~/.mutt/certificates
diff --git a/init.h b/init.h
index 1e7a35ad..ed9b7487 100644
--- a/init.h
+++ b/init.h
@@ -1351,6 +1351,19 @@ struct option_t MuttVars[] = {
   ** if you accept it or not. If you accept it, the certificate can also 
   ** be saved in this file and further connections are automatically 
   ** accepted.
+  ** .pp
+  ** You can also manually add CA certificates in this file. Any server
+  ** certificate that is signed with one of these CA certificates are 
+  ** also automatically accepted.
+  ** .pp
+  ** Example: set certificate_file=~/.mutt/certificates
+  */
+  { "ssl_usesystemcerts", DT_BOOL, R_NONE, OPTSSLSYSTEMCERTS, 1 },
+  /*
+  ** .pp
+  ** If set to \fIyes\fP, mutt will use CA certificates in the
+  ** system-wide certificate store when checking if server certificate 
+  ** is signed by a trusted CA.
   */
   { "entropy_file",	DT_PATH, R_NONE, UL &SslEntropyFile, 0 },
   /*
diff --git a/mutt.h b/mutt.h
index 0fb169d1..69857887 100644
--- a/mutt.h
+++ b/mutt.h
@@ -319,6 +319,7 @@ enum
   OPTSSLV2,
   OPTSSLV3,
   OPTTLSV1,
+  OPTSSLSYSTEMCERTS,
 #endif
   OPTIMPLICITAUTOVIEW,
   OPTMAILCAPSANITIZE,