A way to Block a single CA. Example: Blue Coat Public Services Intermediate CA about openbsd HOT 5 CLOSED

from openbsd.

I can not test it anymore (no access to the network with such a Cert! :( ) but even if true: I seek to "untrust" all signed Certificates by this CA as well! Related to the man-page I am unsure if this Option handles this case. If somebody could test it (from the Devs) and either tell me I am wrong or right (by claiming we need a more simple way to "UNTRUST" such Certs) i'd be thankfull.

I just claimed: As I needed a solution: I did not found one by reading the manpage.. would the "untrust"-Solution solve the Issue I explained?!

Kind regards,
Sebastian Rother

from openbsd.

Related to Stuart Henderson it is not possible to Blog it in a sane way.

http://marc.info/?l=openbsd-misc&m=146469866805382&w=2

I would like to "convert" it to a Feature request. It would be kind if there is a way to archive such things in a easy way (Serverwide, so all Services using LibreSSL simply deny the Certificate as well).

Kind regards,
Sebastian Rother

from openbsd.

Sebastien, please go away.

There is a reason you can't post to the OpenBSD lists. Just please stop.

Thank you

-Bob

On Tue, May 31, 2016 at 7:54 AM, MercSec [email protected] wrote:

Related to Stuart Henderson it is not possible to Blog it in a sane way.

http://marc.info/?l=openbsd-misc&m=146469866805382&w=2

I would like to "convert" it to a Feature request. It would be kind if
there is a way to archive such things in a easy way (Serverwide, so all
Services using LibreSSL simply deny the Certificate as well).

Kind regards,
Sebastian Rother

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#60 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AHv2ddo4hA1fN2Ysr4naLRcpV688Hfv-ks5qHD2AgaJpZM4IoiMQ
.

from openbsd.

I just made a Feature request since this could be usefull for many users.
Why should somebody ask about such a Function at the Mailinglists anyway? I just noticed the answer and thus the ack' that you can not Block a bad Sub-CA. This might be worth getting considered.

from openbsd.