Hi! I've been using OpenSSL for a long time (I bet most of us have), but I nearly always find myself connecting to services using self-signed certificates, and on top of that I'm not very fond of the whole PKI-system. Is it possible to have OpenSSL verify and check the fingerprint of the server-side public cert against a cached one (based on OpenSSL configuration, OpenSSH known.hosts-style), or would it have to be implemented at application-level? If the latter is the case, do you know of any proxy applications that have this functionality?
I am aware that a simple ip/port-filter would not be generic enough for OpenSSL, but perhaps it could be checked against the organization name or the hostname provided in the cert? Joe ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
