Bugtraq mailing list archives

Re: etax 2010 failure to validate remote ssl certificate properly


From: dave b <db.pub.mail () gmail com>
Date: Fri, 10 Sep 2010 01:09:21 +1000

On 8 September 2010 05:17, dave b <db.pub.mail () gmail com> wrote:
On 8 September 2010 05:09, dave b <db.pub.mail () gmail com> wrote:
etax 2010[0]

Minor edit :)
"> (note: you need a certificate for _any_ domain signed by a CA"
should be:
"> (note: you need a certificate for a domain that has been signed by
a signed by a CA installed on the client pc"
i.e. a certificate for https://foo.com that works on the client :)

On a re-test with a fresh vm I found that it will accept any ssl cert,
regardless of being signed by $ca or not.
Sorry for the numerous lame emails :)
-- 
The naked truth of it is, I have no shirt.              -- William Shakespeare,
"Love's Labour's Lost"


Current thread: