dirmngr,gpg: Better diagnostic in case of bad TLS certificates.
d9c793518848
Actions

Description

dirmngr,gpg: Better diagnostic in case of bad TLS certificates.

* doc/DETAILS: Specify new status code "NOTE".
* dirmngr/ks-engine-http.c (ks_http_fetch): Print a NOTE status for a
bad TLS certificate.
* g10/call-dirmngr.c (ks_status_cb): Detect this status.

For example a

gpg -v --locate-external-keys dd9jn@posteo.net

now yields

gpg: Note: server uses an invalid certificate
gpg: (further info: bad cert for 'posteo.net': \
                    Hostname does not match the certificate)
gpg: error retrieving 'dd9jn@posteo.net' via WKD: Wrong name
gpg: error reading key: Wrong name

(without -v the "further info" line is not shown). Note that even
after years Posteo is not able to provide a valid certificate for
their .net addresses. Anyway, this help to show the feature.