OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Ben Laurie (benalgroup.co.uk)
Date: Sun Jan 06 2002 - 14:25:50 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    K.J.MuellerEnBW.com wrote:
    >
    > Hi,
    >
    > could it be, that the text-browsers (lynx, links, w3m) don't even
    > bother comparing the actual server name to the certificate's
    > "issued for" entry?
    >
    > I just tested these and none complained:
    >
    > - lynx 2.8.5dev.2 (with OpenSSL 0.9.6a)
    > - links 0.96
    > - w3m 0.1.11-pre
    > (all on Mandrake Linux 8.1)
    >
    > Neither did any of them complain when accessing a https web page
    > with a self-made certificate.

    They shouldn't complain about the server name (at least, not if its
    right) with a self-made cert. However, they should complain about the
    cert not using a trusted CA.

    Cheers,

    Ben. 

    --
http://www.apache-ssl.org/ben.html