Re: [openssl-users] Question on necessity of SSL_CTX_set_client_CA_list

2018-12-07 Thread Michael Wojcik
> From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of > Blumenthal, Uri - 0553 - MITLL > Sent: Friday, December 07, 2018 15:30 > If there's a non-EV CA that would give you a cert for DNS name amazon.com - > I'd like to make sure it's in my list and > marked Not Trusted.

Re: [openssl-users] Question on necessity of SSL_CTX_set_client_CA_list

2018-12-07 Thread Blumenthal, Uri - 0553 - MITLL
If there's a non-EV CA that would give you a cert for DNS name amazon.com - I'd like to make sure it's in my list and marked Not Trusted. Regards, Uri Sent from my iPhone > On Dec 7, 2018, at 17:02, Kyle Hamilton wrote: > > CAs *do* verify the attributes they certify. That they're not presen

Re: [openssl-users] Question on necessity of SSL_CTX_set_client_CA_list

2018-12-07 Thread Kyle Hamilton
CAs *do* verify the attributes they certify. That they're not presented as such is not the fault of the CAs, but rather of the browsers who insist on not changing or improving their UI. The thing is, if I run a website with a forum that I don't ask for money on and don't want any transactions hap

Re: [openssl-users] Question on necessity of SSL_CTX_set_client_CA_list

2018-12-07 Thread Michael Ströder
On 12/6/18 11:56 PM, Jakob Bohm via openssl-users wrote: > Different levels of certainty is the point. Which never worked well in practice, no matter how hard people tried to clearly define levels if certainty. Ciao, Michael. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org