Re: SKS Keyserver, HKPS and GnuPG 2.1

2015-03-19 Thread Werner Koch
On Wed, 18 Mar 2015 22:52, david.j.woo...@gmail.com said: > I debugged this issue a few days ago. I've posted a patch for testing and > hopefully incorporation into a future GnuPG 2.1 build at It is on my shortlist. Thanks, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgeset

SKS Keyserver, HKPS and GnuPG 2.1

2015-03-18 Thread David Wood
Dear all, Apologies for the thread break - I was reading via the archives and have only just subscribed. I debugged this issue a few days ago. I've posted a patch for testing and hopefully incorporation into a future GnuPG 2.1 build at https://bugs.g10code.com/gnupg/issue1792 With this patch, hk

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Samir Nassar
On Wednesday, March 18, 2015 06:18:53 PM Daniel Kahn Gillmor wrote: > It looks to me like you're using the server's certificate as the CA > certificate. I don't think that's going to work. Maybe you want to use > the Addtrust root cert (attached here) Ahem. You are so very right. Somehow it esca

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Daniel Kahn Gillmor
On Wed 2015-03-18 18:03:11 -0400, Samir Nassar wrote: > On Wednesday, March 18, 2015 10:40:57 PM Kristian Fiskerstrand wrote: >> try renaming /home/snassar/.gnupg/myriapolis.net.crt to >> /home/snassar/.gnupg/myriapolis.net.pem > > Done. It looks to me like you're using the server's certificate a

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Samir Nassar
On Wednesday, March 18, 2015 10:40:57 PM Kristian Fiskerstrand wrote: > try renaming /home/snassar/.gnupg/myriapolis.net.crt to > /home/snassar/.gnupg/myriapolis.net.pem Done. > if that doesn't help , can you increase debug verbosity in > dirmngr.conf and set the logfile? > $ cat dirmngr.conf >

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Kristian Fiskerstrand
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 03/18/2015 10:33 PM, Samir Nassar wrote: > On Wednesday, March 18, 2015 10:14:53 PM Kristian Fiskerstrand > wrote: >> gpg-connect-agent --dirmngr 'KEYSERVER --help' /bye S # Known >> schemata: S # hkp S # hkps S # http S # finger S # >> kd

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Samir Nassar
On Wednesday, March 18, 2015 10:14:53 PM Kristian Fiskerstrand wrote: > gpg-connect-agent --dirmngr 'KEYSERVER --help' /bye > S # Known schemata: > S # hkp > S # hkps > S # http > S # finger > S # kdns Same. When I set the keyserver to: hkp://keyserver.myriapolis.net everything works.

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Kristian Fiskerstrand
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 03/18/2015 10:08 PM, Samir Nassar wrote: > On Wednesday, March 18, 2015 09:21:08 PM Kristian Fiskerstrand > wrote: >> 11371 is expected to be for HKP, so requiring this to be TLS is >> bad practice. > ... > gpg: DBG: chan_4 <- ERR 1 General err

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Samir Nassar
On Wednesday, March 18, 2015 09:21:08 PM Kristian Fiskerstrand wrote: > 11371 is expected to be for HKP, so requiring this to be TLS is bad > practice. Oh oops. Fixed now. > > gpg-connect-agent --verbose --dirmngr 'keyserver > > hkps://keyserver.myriapolis.net:11371' 'ks_get 1e42b367' /bye > >

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Kristian Fiskerstrand
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 03/18/2015 09:13 PM, Samir Nassar wrote: > On Wednesday, March 18, 2015 08:54:47 PM Kristian Fiskerstrand > wrote: >> Hmm, I didn't notice that it was a wildcard cert, that should >> also support holdfast.myriapolis.net in the cert matching, >>

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Samir Nassar
On Wednesday, March 18, 2015 08:54:47 PM Kristian Fiskerstrand wrote: > Hmm, I didn't notice that it was a wildcard cert, that should also > support holdfast.myriapolis.net in the cert matching, however it > results a redirect and404 for [0]. If you add this as a vhost I > suspect it will w

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Kristian Fiskerstrand
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 03/18/2015 08:39 PM, Samir Nassar wrote: > On Wednesday, March 18, 2015 07:28:31 PM Kristian Fiskerstrand > wrote: >> Likely related to the PTR issues[0, 1], its already in the >> roadmap[2] > > Thank you Kristian, > > So I understand this bette

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Samir Nassar
On Wednesday, March 18, 2015 07:28:31 PM Kristian Fiskerstrand wrote: > Likely related to the PTR issues[0, 1], its already in the roadmap[2] Thank you Kristian, So I understand this better. When using non-encrypted connections GnuPG doesn't have a problem, but when I am using a wildcard certifi

Re: SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Kristian Fiskerstrand
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 03/18/2015 03:54 PM, Samir Nassar wrote: > Hello, > > I originally posted this on the sks-devel mailing list, but after > thinking about it, I believe this might be something I am doing > wrong on the GnuPG side.: > > I set up a keyserver at key

SKS Keyserver, HKPS, and GnuPG 2.1

2015-03-18 Thread Samir Nassar
Hello, I originally posted this on the sks-devel mailing list, but after thinking about it, I believe this might be something I am doing wrong on the GnuPG side.: I set up a keyserver at keyserver.myriapolis.net. What I have done so far: Installed sks (1.1.5) from wheezy-backports SKS is beh