Re: [PATCH] openssl: allow partial trust chains
Date: Mon, 14 Dec 2015 16:49:01 +0100
On Monday 14 December 2015 15:50:25 Daniel Stenberg wrote:
> On Wed, 25 Nov 2015, Reiner Herrmann wrote:
> > By default OpenSSL only accepts connections if the full chain to the root
> > can be verified. If only an intermediate CA in the chain is trusted,
> > setting this flag also allows the connection when the root CA is not
> > trusted. This is also the default behavior for e.g. GnuTLS.
> Hi again, let's bring this patch back to life.
> What would you say about adding a bit to the CURLOPT_SSL_OPTIONS option to
> allow an application to optionally switch off "partial trust chains" ?
What about adding an option to switch on "partial trust chains" ?
Than take time to discuss this issue with *real experts* and eventually change
the default if you are 100% sure to do the right thing ?
- application/pgp-signature attachment: This is a digitally signed message part.