Subject: SSL Certificates in PC-PINE

From: "S. Alexander Jacobson" <[email-masked]>
Date: Fri, 26 Oct 2001 10:25:59 -0400 (Eastern Daylight Time)

By default PC-Pine allows you either no SSL authentication
(novalidate-cert) which is VERY unsafe.  Or requires your server's
certificate to be signed by some approved Certificate Authority
(presumably Verisign).

However, if I have a secure way of recieving my server's
(self-signed) certificate, I don't need Verisign, I just need Pine to
recognize my server's certificate as OK.

Since I don't want to pay Verisign for a cert, and I do have a secure way
of obtaining my server's cert, I see two ways of getting secure server
authentication?
1. Adding my server as a Pine Approved Certificate Authority
-or-
2. Getting Pine specifically to approve this and only this
certificate (e.g. because it matches some client side file).

Can someone tell me how to accomplish either of these?

On a related note, can someone tell me how to install a client side
certificate, so my server can authenticate me?

-Alex-

___________________________________________________________________
S. Alexander Jacobson                   Shop.Com
1-646-638-2300 voice                    The Easiest Way To Shop (sm)

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Terry Gray <[email-masked]>
Date: Wed, 31 Oct 2001 08:31:17 -0800 (Pacific Standard Time)

Alex,
For what it's worth, I believe your assumption is incorrect.
Absence of server cert validation does not imply that the session is
unencrypted, only that you don't really know who the session is with.
So there are three, not two, possible scenarios.

-teg

p.s. Pine has no notion of "Approved" CAs itself, but relies on whatever
Microsoft, OpenSSL, etc, provide to it.