GNU bug report logs - #22297
24.5; gnutls builds do not verify https by default

Previous Next

Package: emacs;

Reported by: Glyph Lefkowitz <glyph <at> twistedmatrix.com>

Date: Sun, 3 Jan 2016 09:38:02 UTC

Severity: normal

Found in version 24.5

Fixed in version 25.1

Done: Glenn Morris <rgm <at> gnu.org>

Bug is archived. No further changes may be made.

Full log

View this message in rfc822 format

From: Lars Magne Ingebrigtsen <larsi <at> gnus.org>
To: Glyph Lefkowitz <glyph <at> twistedmatrix.com>
Cc: 22297 <at> debbugs.gnu.org
Subject: bug#22297: 24.5; gnutls builds do not verify https by default
Date: Sun, 03 Jan 2016 10:43:37 +0100

Glyph Lefkowitz <glyph <at> twistedmatrix.com> writes:

> ;; This elisp program illustrates the issue.
>
> (require 'cl)
> (let ((bad-hosts
>        (loop for bad
> 	     in `("https://wrong.host.badssl.com/"
> 		  "https://self-signed.badssl.com/")
> 	     if (condition-case e
> 		    (url-retrieve
> 		     bad (lambda (retrieved) t))
> 		  (error nil))
> 	     collect bad)))
>   (if bad-hosts
>       (error (format "tls misconfigured; retrieved %s ok"
> 		     bad-hosts))
>     (url-retrieve "https://badssl.com"
> 		  (lambda (retrieved) t))))

I'm unable to reproduce the problem.  With an Emacs built with GnuTLS, I
get warnings about invalid certificates.  

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no
This bug report was last modified 9 years and 143 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.