Victor Duchovni wrote: > Use a self-signed cert and and a trusted source of peer<->cert or cert > fingerprint mappings. The public CA is just one mapping function.
Well then you're going to have to argue with yourself since you said not to do this two posts ago: >>>Actually not the certificate, it has to be a nonce securely derived from >>>the current SSL handshake, the certificate alone does not qualify. Now you *are* saying that if you just use something to validate the certificate, you are safe. You and I are in violent agreement, you just don't see it. You also suggest setting up an SSL connection that provides everything except MITM detection. You then take something from the SSL connection that a MITM cannot fake (in your case, the server's certificate and thus private key, in my case, the finished messages which depend on the keys) and verify it by a means outside of the SSL protocol. DS ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
