diff options
| author | Lee Clagett <code@leeclagett.com> | 2019-03-11 22:01:03 -0400 |
|---|---|---|
| committer | Lee Clagett <code@leeclagett.com> | 2019-04-06 23:47:06 -0400 |
| commit | a3b0284837c9ea10865e6ddeb7f1244d621ae5c0 (patch) | |
| tree | 2c9738f2ac773eb44c6579c692c006eb75fb12f2 /contrib/CMakeLists.txt | |
| parent | Merge pull request #5364 (diff) | |
| download | monero-a3b0284837c9ea10865e6ddeb7f1244d621ae5c0.tar.xz | |
Change SSL certificate file list to OpenSSL builtin load_verify_location
Specifying SSL certificates for peer verification does an exact match,
making it a not-so-obvious alias for the fingerprints option. This
changes the checks to OpenSSL which loads concatenated certificate(s)
from a single file and does a certificate-authority (chain of trust)
check instead. There is no drop in security - a compromised exact match
fingerprint has the same worse case failure. There is increased security
in allowing separate long-term CA key and short-term SSL server keys.
This also removes loading of the system-default CA files if a custom
CA file or certificate fingerprint is specified.
Diffstat (limited to 'contrib/CMakeLists.txt')
0 files changed, 0 insertions, 0 deletions