On Wed, Jun 09, 2010 at 06:30:59PM +0200, Jan C. wrote:
> Hello,
> ok then t least I know what's the origin of the behavior I had.
>
> On Wed, Jun 9, 2010 at 6:12 PM, Victor Duchovni
> <[email protected]> wrote:
> > I guess our documentation has never promised the use of system CAs when
> > CApath or CAfile are set, failing to override the system settings is
> > counter-intuitive, so I can support this change. We'll also have to
> > document the semantics of "CAfile == CApath == <empty>".
>
> so what I should do is to suppose that only the certs from
> smtp_tls_CApath are trusted and that's all. If I need the system CAs,
> I should copy them to my smtp_tls_CApath directory .. correct ?
Probably, although I don't think we've reached a final decision yet...
My preference is to not trust some random list of CAs that came with the
O/S OpenSSL package when the user specifies an explicit CAfile/CApath,
but this would be an incompatible change.
In my case, the OpenSSL package I use is built by me, and has an empty
default list of trusted CAs, so I never notice the extra default certs.
--
Viktor.
