CAcert Code Development list.

["Ian G (Audit)" <iang AT cacert.org>]

On 8/4/09 16:09, Philipp Gühring wrote:
> Hi Martin,
>
> > should i be able to login by client-certificate?
>
> No.
> The test-system had started with an empty database (due to privacy
> reasons, we did not copy any user-data from the production system),
> so you can only login to the testsystem with a client-certificate that
> was issued by the testsystem.


Um.  Off original topic:  And what does it do with a CAcert signed 
certificate that *wasn't* issued by the system?

The basic point of certificates was that we could rely on the signed 
data on the basis of only the signatures chain, and not have to store 
things.

Obviously the issuer also has the luxury of storing things ... so I can 
see the merit in the above notion of only accepting issued certs, an 
advantage that is unavailable to others.

I'm just wondering what happens in the "impossible" case :)

iang

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature