Re: Gajim fails to handle invalid certificates

[Florian Weimer <fweimer () redhat com>]

On 11/14/2012 08:19 AM, Kurt Seiifried wrote:

> So do we consider this to be an OpenSSL issue of gajim? I'm sure gajim
> is not the only program that does something like this.

As far as I understand things, it is not necessarily at all to set a 
verification callback in OpenSSL.  If you load the root certificate 
store and examine SSL_get_verify_result, that should be sufficient.  You 
can even look at the peer certificate and continue anyway if the user 
has overridden the certificate validity.  So far, I haven't found a good 
reason to use a verify callback at all.  You need it to implement a 
custom PKIX validation policy, but that should be pretty rare.  (I still 
have to check older OpenSSL versions, though, perhaps there, the 
behavior was different.)

Anyway, if application developers set a verification callback, it is 
their responsibility to implement it correctly.  Therefore, I don't 
think this is an OpenSSL issue.

--
Florian Weimer / Red Hat Product Security Team