Changes between Version 7 and Version 8 of Encryption

Timestamp:

08/09/16 04:10:01 (5 years ago)

Author:

Antoine Martin

Comment:

--

Encryption

@@ -82 +82 @@
 [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)
 }}}
-temporarily add {{{--ssl-server-verify-mode=none}}} to your client command line.
+'''temporarily''' add {{{--ssl-server-verify-mode=none}}} to your client command line.
 }}}
+
+
+{{{
+== Securing with self signed certificates ==
+
+See [https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software] and [https://blog.sucuri.net/2016/03/beware-unverified-tls-certificates-php-python.html Beware of Unverified TLS Certificates in PHP & Python].
+See also: [https://lwn.net/Articles/666353/ Fallout from the Python certificate verification change].
+
+Since the server certificate will not be signed by any recognized certificate authorities, you will need to send the ca_cert file to the client via some other means... This will no be handled by xpra, it simply cannot be. (same as the AES key, at which point... you might as well use AES)
+
+See [https://carlo-hamalainen.net/blog/2013/1/24/python-ssl-socket-echo-test-with-self-signed-certificate Python SSL socket echo test with self-signed certificate] for generating this x509 keystore. (''server.crt'' in this example).
+}}}