I looked more closely and found that the slapd (TLS server) system (running squeeze) has the old CACert class 3 root, signed by the class 1 root using md5 wheezy has the new version, signed by the sign class 1 using SHA256 CACert released the new version of the cert (using the same RSA key pair, just a different sig algorithm): http://wiki.cacert.org/FAQ/Class3Resign I copied that from wheezy to squeeze, restarted slapd, and the wheezy client connects to the slapd on squeeze now Therefore, I believe the 0x102 error code was revealing the use of MD5 in the cert sent down by the server - even though a local copy of the same cert (with same RSA key pair) has the SHA256 signature On the squeeze machine, I notice that `apt-get upgrade' failed to bring in a new copy of the certificate. Could GnuTLS deal with this more elegantly, noticing that the same key pair is in use, for example, and ignoring the use of MD5? Could more be done to warn people and or encourage them to deploy the new Class3 root to older machines before deploying wheezy? -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
