Re: SSL/TLS question

2004-01-15 Thread Wil Cooley
On Wed, 2004-01-14 at 19:03, Craig Ringer wrote: > > He is - he's just using one signed by someone who was > > signed by a known authority. Nothing needs to be installed in the > > browser. > > OK - I must've misunderstood his initial email. Yes, on re-reading my post after your initial messag

Re: SSL/TLS question

2004-01-15 Thread Wil Cooley
On Wed, 2004-01-14 at 16:05, Joe Rhett wrote: > Use the exact same files for the web server as for the Cyrus mail server. > They're both using the same library. Well, in Apache I have the following, in addition to the usual 'SSLCertificateFile' and 'SSLCertificateKeyFile' directives: SSLCertifi

Re: SSL/TLS question

2004-01-14 Thread Craig Ringer
Craig Ringer wrote: That appears to depend on the client - it certainly doesn't work with Mozilla, and Eudora needs some manual steps that the users seem to have trouble with. OTOH, it _shouldn't_ work automatically; the cert is no more inherently trustworthy than any random one somebody has gen

Re: SSL/TLS question

2004-01-14 Thread Craig Ringer
Joe Rhett wrote: I expect that'd do it; you'll still need to install the CA certificate in browsers, though. I have a similar setup, but with a CA cert generated in-house. No you don't. The server hands out both certificates during the connection process. It just works ;-) That appears to depend

Re: SSL/TLS question

2004-01-14 Thread Joe Rhett
On Mon, Jan 12, 2004 at 07:25:33PM -0800, Wil Cooley wrote: > [Sorry this is a repost from a month ago; I didn't get an answer then, > but maybe my timing is better now.] > > For my web server, I use a certificate from Comodo which is very > inexpensive by comparison with Thawte/Verisign certs, bu

Re: SSL/TLS question

2004-01-14 Thread Joe Rhett
> I expect that'd do it; you'll still need to install the CA certificate > in browsers, though. I have a similar setup, but with a CA cert > generated in-house. No you don't. The server hands out both certificates during the connection process. It just works ;-) > I then install the ca cert i

Re: SSL/TLS question

2004-01-12 Thread Craig Ringer
Wil Cooley wrote: [Sorry this is a repost from a month ago; I didn't get an answer then, but maybe my timing is better now.] For my web server, I use a certificate from Comodo which is very inexpensive by comparison with Thawte/Verisign certs, but it requires installation of an intermediary key for