Dan Strick <mla_str...@att.net> writes: > I just installed FreeBSD release 8.1 and rebuilt the fetchmail port. > Now I get messages like these when I run fetchmail: > --- snip --- > > I can get rid of the message by removing the ssl option from the user > line but then fetchmail would not even try to use ssl. Why would the > old fetchmail be better able to verify the server's ssl certificate? > Has openssl changed? Where is the openssl certificate directory and why > should the information needed to verify the server's certificate be > found on my machine? Doesn't the openssl library contain something > like a hardwired list of well known certificate authority systems?
You already got replies about using the sslcertfile option pointing to /usr/local/share/certs/ca-root-nss.crt. The problem is that only fixes fetchmail and must be duplicated for each application. I finally got around to looking into how to integrate those certificates into the openssl configuration for FreeBSD, and the following is what I came up with. The openssl configuration in /etc/ssl/openssl.cnf expects all certificates and hashes to be in /etc/ssl/certs, so the certificate file must be split into individual certificates there, and hashes generated. The following steps will handle that. Some of these steps must be performed as root, so all of them might as well be. cd /etc/ssl/certs # create if necessary split -p '^Certificate:' /usr/local/share/certs/ca-root-nss.crt cert rm certaa # just the file header for file in cert* ; do mv $file $file.pem ; done # rename to certxx.pem perl /usr/src/crypto/openssl/tools/c_rehash . # generate the hashes The above steps are for a FreeBSD 8.1-RELEASE, so they might not work exactly for other versions. This also assumes that you trust the certificates in the ca_root_nss package, so you will have to decide that for yourself. I have seen several questions and problems about ssl certificates, so hopefully others will find this useful. -- Carl Johnson ca...@peak.org _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
