[pca] PCA and HTTPS
Martin Paul
martin at par.univie.ac.at
Mon Aug 4 15:34:38 CEST 2008
In the current development release of pca (20080804-01) I've made a few
changes to the HTTPS code.
While there is an HTTPS-capable version of wget in Solaris 10, none of
the common public root certificates are included, so unless one uses
--no-check-certificate with wget it will always fail when using https
URLs. Until recently, I've used the no-check option in pca to make https
downloads work at all, but that's not a solution, of course.
So I included the VeriSign root CA certificate, which has been used to
sign the certificate of sunsolve.sun.com in pca itself and point wget at
that. So when using "--sprot=https" with pca now, it will download all
files (xref, patches, READMEs) from SunSolve via HTTPS securely.
I have also included the Cybertrust CA certificate used for the
certificate on pca's distribution web server (www.par.univie.ac.at). If
you set "pcaurl=https://www.par.univie.ac.at/", the internal update
function of pca (pca --update ...) will download new versions of itself
securely via HTTPS as well.
I did not change the default from HTTP to HTTPS for any download, as
there are still a lot of systems without SSL-enabled wget.
Thanks to Christopher Odenbach, who provided ideas and details to get
this done.
Martin.
More information about the pca
mailing list