Subject: Accepting ssl Certificates

From: Steve Lowe <[email-masked]>
Date: Sun, 16 Sep 2001 21:57:55 -0500 (CDT)

I am using the openssl 0.9.6 on a small Digital Unix platform.  I updated
by inetd.conf file to include the line for imapds, along with including
imapds 993/tcp in the /etc/services file.  The appropriate imapd.pem was
produced.

When I access the system using PC-PINE 4.40, I am prompted on the
certificate.  So far, so good.  If I trust the certificate, I enter 'Y'.
I can bypass the certificate check with the option /novalidate-cert.

If I modify my pinerc file to bypass the certificate check, I would hazard
a guess that I am still running secure -- I trust the fact that I am
connecting to the correct mail server.

Have I thought through this process correctly?

Thanks in advance.

 -- Steve

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Steve Hubert <[email-masked]>
Date: Mon, 17 Sep 2001 10:03:19 -0700 (Pacific Daylight Time)

Yes, it is still encrypted. If you are connected to the correct host, you
are ok. You don't really know you are connected to the correct host
without the certificate validation.

-- 
Steve Hubert <[email-masked]>
Networks and Distributed Computing, Univ. of Washington, Seattle