Home GnuPG
Diffusion GnuPG 3efc94f1eb17

dirmngr,gpg: Better diagnostic in case of bad TLS certificates.

Description

dirmngr,gpg: Better diagnostic in case of bad TLS certificates.

* doc/DETAILS: Specify new status code "NOTE".
* dirmngr/ks-engine-http.c (ks_http_fetch): Print a NOTE status for a
bad TLS certificate.
* g10/call-dirmngr.c (ks_status_cb): Detect this status.

For example a

gpg -v --locate-external-keys dd9jn@posteo.net

now yields

gpg: Note: server uses an invalid certificate
gpg: (further info: bad cert for 'posteo.net': \
                    Hostname does not match the certificate)
gpg: error retrieving 'dd9jn@posteo.net' via WKD: Wrong name
gpg: error reading key: Wrong name

(without -v the "further info" line is not shown). Note that even
after years Posteo is not able to provide a valid certificate for
their .net addresses. Anyway, this help to show the feature.

  • Signed-off-by: Werner Koch <wk@gnupg.org>

Details

Provenance
wernerAuthored on Nov 18 2019, 6:23 PM
Parents
rG4dd509912524: dirmngr: Forward http redirect warnings to gpg.
Branches
Unknown
Tags
Unknown