Re: gnutls tofu support? or even --insecure?

[Ted Zlatanov]

On Wed, 12 Aug 2015 14:21:49 +0100 Nix <address@hidden> wrote: 

N> On 11 Aug 2015, Toke Høiland-Jørgensen outgrape:
>> Well, the outcome was that the new network manager functionality would
>> replicate the tofu functionality in lisp and delegate only the
>> certificate checking to gnutls. But I lost track of what happened after
>> that; think the functionality was merged?

N> It was, but I'm still being asked about certs on every Emacs restart --
N> it doesn't seem to be remembering anything persistently.

I'm not asked, and certs are stored for me. Can you check the cert
storage?

#+begin_src text
% cat ~/.emacs.d/network-security.data                                          
                                        *[master] 
(
 (:id "sha1:f80ca63ad4bad106ae2a39e488272df8ddc4aaf8" :fingerprint 
"sha1:44:b4:29:38:9c:0c:68:f0:00:13:37:f3:90:42:94:17:08:e0:93:10" :host 
"letsencrypt.org:443")
...
)
#+end_src

N> It's clearly not the same as --tofu -- if gnutls doesn't like a
N> connection, it's not going to let you in, even if it connected perfectly
N> well to it in the past. This is true *no matter what* Emacs does -- I
N> don't see how you can possibly hope to replicate the 'connected fine
N> before, connect again without cert complaint or checking the cert chain'
N> without actually telling gnutls not to check the cert chain... which
N> this fault suggests is not happening.

I haven't experienced this issue myself, but maybe you can describe
the expected vs. actual behavior and how it can be improved in more
detail?  I can't follow your text, sorry.

Ted