Last modified: 2013-03-16 23:22:09 UTC
see also bug 45324 . The implementation would require a user_openid table schema change, so that an additional column uoi_openid_ignore_certificate_check can be added and can be set to "1". (per user). "per-OpenID provider" would either require + an additional database table openid_providers which save their properites including whether not to ignore certificate checks; or + hard-coding the value for the preprogrammed providers. A setting (checkbox "ignore certificate checks") for manually entered OpenIDs must be added on the Login and Convert panels.
add to the the per-openid provider and/or per-user solution; + show OpenID provider's fingerprint + store fingerprint if user accepted + alert, if during the next authentication the current and stored fingerprints differ
see https://sourceforge.net/p/curl/feature-requests/69/
SHA-1 example for OPENSSL (tested) echo -n | openssl s_client -connect www.google.org:443 2>/dev/null | sed -n "/BEGIN CERTIFICATE/,/END CERTIFICATE/p" | openssl x509 -fingerprint -sha1 -noout results in output: "SHA1 Fingerprint=15:23:B4:8F:71:6F:E7:88:55:17:58:19:F3:D4:C0:59:8A:07:73:44" see http://serverfault.com/questions/139728/how-to-download-ssl-certificate-from-a-website Example for GNUTLS (untested): The GNUTLS client tool, gnutls-cli, can also make this easy: gnutls-cli --print-cert www.example.com < /dev/null > www.example.com.certs The program is designed to provide an interactive client to the site, so you need to give it empty input to end the interactive session.
*** Bug 45956 has been marked as a duplicate of this bug. ***
Here's a simple cert viewer in PHP https://github.com/Wikinaut/MySimpleCertViewer
closed after discussion with Ryan ("there's never a good reason to allow insecure checking")
