[pca] PCA and HTTPS

Martin Paul martin at par.univie.ac.at
Mon Aug 4 15:34:38 CEST 2008


In the current development release of pca (20080804-01) I've made a few 
changes to the HTTPS code.

While there is an HTTPS-capable version of wget in Solaris 10, none of 
the common public root certificates are included, so unless one uses 
--no-check-certificate with wget it will always fail when using https 
URLs. Until recently, I've used the no-check option in pca to make https 
downloads work at all, but that's not a solution, of course.

So I included the VeriSign root CA certificate, which has been used to 
sign the certificate of sunsolve.sun.com in pca itself and point wget at 
that. So when using "--sprot=https" with pca now, it will download all 
files (xref, patches, READMEs) from SunSolve via HTTPS securely.

I have also included the Cybertrust CA certificate used for the 
certificate on pca's distribution web server (www.par.univie.ac.at). If 
you set "pcaurl=https://www.par.univie.ac.at/", the internal update 
function of pca (pca --update ...) will download new versions of itself 
securely via HTTPS as well.

I did not change the default from HTTP to HTTPS for any download, as 
there are still a lot of systems without SSL-enabled wget.

Thanks to Christopher Odenbach, who provided ideas and details to get 
this done.

Martin.



More information about the pca mailing list