Tickets :: Comment on [#13730] Implementation of peer verification in TLS connections

* Your Email Address
* Spam protection	Enter the letters below: . .. ..___. .. . \| \|\ / \| \|\| \| \|__\| \/ \| \__\|\|/\\|
Comment	> On my server I need the peer verification to connect to a remote IMAP > server. Therefore I focused my effort on that. To avoid using > $GLOBALS I moved all configuration options in the backend config of > IMP. This way every backend can be configured seperately. > > === How does it work? === > There is a new array in the backend config file named "tls_params". > This stores all necessary information for the TLS connection. Please > refer to the documentation in backends.conf for details. The involved > libraries are modified to pass tls_params to Socket Client, where > they are used to create the SSL context. A new feature is the > fingerprint check. This cannot be done directly by setting the SSL > context, because the encryption is enabled after the socket is > created. Therefore this check has to be done seperatly after the > starttls command. > > === Benefits === > Peer verification with a trusted bundle of certificate authorities > can be enabled for remote IMAP servers. Further the connection can be > limited to a specified certificate by its fingerprint. > > === Regressions === > There are no regression I am aware of. As long as the new > configuration array (tls_params) is not used, the library will work > as usually.
Attachment
Watch this ticket