Subject: [Imap-uw] Where does c-client smtp get its certificates?

From: Mike Schmidt <[email-masked]>
Date: Fri, 03 Jun 2005 18:23:02 -0400

Hi,

There is some talk of openssl in the build instructions for c-client, 
but nothing is mentioned for windows. After using it a few times, I came 
to the conclusion that c-client is fetching the certificates it needs 
from the standard Windows certificate stores. The code confirms this.

But if there are several certificates in the user's personal store, how 
is the certificate selected? I have a situation where there are always 
at least two certificates in the user's personal store, and c-client 
picks the right one on two occasions (the one with the user's email 
address) and on the other occasion it picks the wrong one (one without 
the user's email address - or the user's name). The second certificate 
is a special-purpose certificate used by a group, thus does not have the 
right user credentials. It's accepted anyway by sendmail, (it has the 
right root), but mis-identifies the user.

Does anyone know how I can influence that decision?

Thanks for any ideas you may have.

Mike

_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Fri, 3 Jun 2005 15:33:21 -0700 (Pacific Daylight Time)

The Windows SSL code in c-client (which uses Microsoft SSPI) doesn't 
attempt to do anything about client certificates.  It only validates the 
server certificate.  If client certificates are used at all in the 
negotiation, it is SSPI/Windows that is doing that.

If you want to try to implement client certificates, the routine that you 
need to modify is ssl_start() in imap-200?/src/osdep/nt/ssl_w2k.c (maybe 
also ssl_nt.c and ssl_old.c).

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mike Schmidt <[email-masked]>
Date: Sat, 04 Jun 2005 01:22:19 -0400

Thanks, Mark. I clearly see the certificates from the client in 
sendmail's log file. Here's an example:

Jun  3 13:09:14 st sendmail[18951]: STARTTLS=server, 
cert-subject=/DC=com/DC=TT-eXpress/OU=Main+20Directory/CN=Mike+20Schmidt/serialNumber=17, 
cert-issuer=/DC=com/DC=TT-eXpress/CN=TT-eXpress+20Root+20Authority+20CA+201, 
verifymsg=ok

This is clearly my certificate used for the TLS connection. If I 
understand correctly, c-client isn't doing the TLS negociation, 
Microsoft SSPI is. Sometimes there's no certificate, so I guess in that 
case only the server cert is checked.

I must say that I'm really pleasantly surprised by the way c-clients 
handles this. It works beautifully. Now, all I need to do is get some 
control over the client certs. Overall, I find my experience with 
c-client to be very positive.

Thanks, Mark. I appreciate c-client more and more as I work with it.

Mike

Mark Crispin wrote:

> attempt to do anything about client certificates.  It only validates 
> the server certificate.  If client certificates are used at all in the 
> If you want to try to implement client certificates, the routine that 
> you need to modify is ssl_start() in imap-200?/src/osdep/nt/ssl_w2k.c 
> (maybe also ssl_nt.c and ssl_old.c).
>
> -- Mark --
>