;;; tls.el --- TLS/SSL support via wrapper around GnuTLS
-;; Copyright (C) 1996-1999, 2002-2015 Free Software Foundation, Inc.
+;; Copyright (C) 1996-1999, 2002-2016 Free Software Foundation, Inc.
;; Author: Simon Josefsson <simon@josefsson.org>
;; Keywords: comm, tls, gnutls, ssl
;;; Code:
+(require 'gnutls)
+
(autoload 'format-spec "format-spec")
(autoload 'format-spec-make "format-spec")
:type 'regexp
:group 'tls)
-(defcustom tls-program '("gnutls-cli -p %p %h"
- "gnutls-cli -p %p %h --protocols ssl3"
- "openssl s_client -connect %h:%p -no_ssl2 -ign_eof")
+(defcustom tls-program
+ '("gnutls-cli --x509cafile %t -p %p %h"
+ "gnutls-cli --x509cafile %t -p %p %h --protocols ssl3"
+ "openssl s_client -connect %h:%p -no_ssl2 -ign_eof")
"List of strings containing commands to start TLS stream to a host.
Each entry in the list is tried until a connection is successful.
-%h is replaced with server hostname, %p with port to connect to.
+%h is replaced with the server hostname, %p with the port to
+connect to, and %t with a file name containing trusted certificates.
The program should read input on stdin and write output to stdout.
See `tls-checktrust' on how to check trusted root certs.
:type
'(choice
(const :tag "Default list of commands"
- ("gnutls-cli -p %p %h"
- "gnutls-cli -p %p %h --protocols ssl3"
- "openssl s_client -connect %h:%p -no_ssl2 -ign_eof"))
+ ("gnutls-cli --x509cafile %t -p %p %h"
+ "gnutls-cli --x509cafile %t -p %p %h --protocols ssl3"
+ "openssl s_client -CAfile %t -connect %h:%p -no_ssl2 -ign_eof"))
(list :tag "Choose commands"
:value
- ("gnutls-cli -p %p %h"
- "gnutls-cli -p %p %h --protocols ssl3"
+ ("gnutls-cli --x509cafile %t -p %p %h"
+ "gnutls-cli --x509cafile %t -p %p %h --protocols ssl3"
"openssl s_client -connect %h:%p -no_ssl2 -ign_eof")
(set :inline t
;; FIXME: add brief `:tag "..."' descriptions.
;; (repeat :inline t :tag "Other" (string))
- ;; See `tls-checktrust':
- (const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h")
- (const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h --protocols ssl3")
- (const "openssl s_client -connect %h:%p -CAfile /etc/ssl/certs/ca-certificates.crt -no_ssl2 -ign_eof")
;; No trust check:
- (const "gnutls-cli -p %p %h")
- (const "gnutls-cli -p %p %h --protocols ssl3")
+ (const "gnutls-cli --insecure -p %p %h")
+ (const "gnutls-cli --insecure -p %p %h --protocols ssl3")
(const "openssl s_client -connect %h:%p -no_ssl2 -ign_eof"))
(repeat :inline t :tag "Other" (string)))
(list :tag "List of commands"
(format-spec
cmd
(format-spec-make
+ ?t (car (gnutls-trustfiles))
?h host
?p (if (integerp port)
(int-to-string port)