<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA1 <br>
<br>
<br>
04.02.2015 9:16, Amos Jeffries пишет:<br>
<span style="white-space: pre;">> On 4/02/2015 7:50 a.m., Yuri
Voinov wrote:<br>
><br>
> > Now I have:<br>
><br>
> > root @ cthulhu /etc/opt/csw/ssl/certs # ls -al *.pem|wc
-l 210<br>
><br>
> > root and intermediate CA's. Most known I can found.<br>
><br>
> > Note: all of them was wound in different places - in
addition with<br>
> > Mozilla's bundle, shipped with OpenSSL.<br>
><br>
> > How I can found, which is absent?<br>
><br>
> Depends on your definition of "absent". If one was being
really<br>
> serious about the security the Trusted CA list would be
empty.**</span><br>
It not my definition. Squid tells this. :) It indicates it as
unknown CA.<br>
<br>
<span style="white-space: pre;">><br>
> All the domains using DANE and TLSA DNS records? I am hoping
someday<br>
> to have Squid fetch and use those instead of the Trusted CA,
but that<br>
> is a while off. (hint, hint sponsorship welcome etc. and so
on).<br>
><br>
><br>
> > And how to support this heap? In practice? Manually with
CLI<br>
> > openssl? Ok, but how to identify problem URL, when
Squid's load<br>
> > over 100 requests per second?<br>
><br>
> With the cert validator helper I think. Probably something
custom.</span><br>
Agrrrrrrrrrrrrrrhhhhhhhhhhhhhhhhh........ Will think.<br>
<span style="white-space: pre;">><br>
><br>
> ** The point of the word "Trusted" in Trusted CA is that they
have<br>
> passed through some difficult criteria to get listed and
installed.<br>
> Just grabbing CA certs from all over the place is risking a
huge<br>
> amount. The major well-known security flaw in the whole
TLS/SSL system<br>
> is that any one of the Trusted CAs is capable of forging
signatures on<br>
> other CAs clients. So dodgy list entries is a VERY big deal.</span><br>
Agreed. Of course, CA's cant be get anywhere. As minimum, from
provider's sites.<br>
<br>
On the other hand, every of them cannot be checked (and could not
be) in deep. We just get it and trast. This is wrong concept, but we
haven't anything else....<br>
<br>
<span style="white-space: pre;">><br>
> Amos<br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBAgAGBQJU0d3fAAoJENNXIZxhPexGozoH/Ri2ljZrROkZ+9RLqr6gY0U+
<br>
ckpX1bZUp3hmOw+i6fdASJHL2Wj4mXe7LMvTOr9P7oKiW8H0r/sAfh2zlcss2WIA
<br>
aQA+TntAyWJG66NH0MBJbTWtnlmDGMV11i2g5B30jUg7G1KPIAGd2IW1fi/Uf3Kb
<br>
bNuT5lFz6peG2l04qMjwY26xhaM+IQIh0b1JyKtpiqNnwjLw/gLpESvJB1Ah8LST
<br>
CgLsM+j5w/2sTPeg/K+SIvYwfRpng/XgvedONY0eL6RTWY1xnWS4zWmn29ZmRqkx
<br>
tAJZVHHQl4NhpJ8ulYUi1ILgWLK2FYIqTZ0ctXOpRBmNwGqPFhvA1SY7K43d5ew=
<br>
=HwCL
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>