5 ms·
Interestingly, both Lynx and Wget don't throw any warning at all. It's really surprising for Lynx, you would think THE nerd browser would be a bit better secur
by ama729 13y ago
Interestingly, both Lynx and Wget don't throw any warning at all.
It's really surprising for Lynx, you would think THE nerd browser would be a bit better security wise.
- e12e 13y agoI can't seem to find any command line tool (including openssl s_client) that will automatically "do the right thing". Curl, wget, w3m and lynx and "openssl s_client -connect revoked.grc.com:433" all happily connect without warning. So much for downloading install scripts over ssl...
- dredmorbius 13y agoNo, man, you've got to curl straight to bash. As root. God I fucking hate that.
- e12e 13y agoI guess that's one more reason to install an ssl unwrapping proxy -- allows you to log what comes sailing in over ssl (if you should be so inclined) -- and at least the proxy could make sure to drop connections to sites with revoked certs. It would make it more difficult to connect to sites that use alternative CAs/self-signed certs, though..
- e12e 13y agoOk, so gnutls-cli from libgnutls 3.2 has a --ocsp parameter, that turns on ocsp. And it sort of "works": $ gnutls-cli -p 443 --ocsp revoked.grc.com (..) Resolving 'revoked.grc.com'... Connecting to '4.79.142.205:443'... - Certificate type: X.509 - Got a certificate list of 2 certificates. - Certificate[0] info: (...) - Status: The certificate is trusted. Connecting to OCSP server: ocsp.digicert.com... Resolving 'ocsp.digicert.com'... Connecting to '93.184.220.29:80'... *** Verifying OCSP Response: Failure, Signature failure. *** OCSP response ignored ^^^^^^^ ! WTF? So, by working, I mean that it doesn't work.