Mailing-List: contact user-help@commons.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Commons Users List" <user@commons.apache.org>
Received-SPF: pass (athena.apache.org: domain of carlerberg@gmail.com
 designates 209.85.215.43 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5255BFA7.2000807@gmail.com>
References: 
 <CAGYs6nRS6pkeeoxScJC3xcNiv4cHLY9Ho+SagXMET9DzO2f1Vg@mail.gmail.com>
	<5255BFA7.2000807@gmail.com>
Date: Thu, 10 Oct 2013 10:55:18 +0200
Message-ID: 
 <CAGYs6nQb163SM4muYkn1F=GcKWZtqU-6Y=Ec9Yiir7ZMB+GzAg@mail.gmail.com>
Subject: Re: [email] TLS not verified properly (security issue)
From: Carl Erberg <carlerberg@gmail.com>
To: Commons Users List <user@commons.apache.org>
Content-Type: multipart/alternative; boundary=089e01176915441ca904e85f29b4

--089e01176915441ca904e85f29b4
Content-Type: text/plain; charset=UTF-8

Hi Thomas,

thanks for your help and pointing out System.setProperty("javax.net.debug",
"all");
I found out that I had two problems:

a) I had the key for that CA added to my Debian system some time ago so the
validation which I expected to fail did not. I just didn't remember. Stupid
me.

b) I used the gnu javamail implementation. This one still does not
complain, even when I remove my CA from the system via "dpkg-reconfigure
ca-certificates" .  Now I use the jar from
https://java.net/projects/javamail/pages/Home and everything works as it
should (i.e. I get an error when the CA is removed).

Could you test your example with the gnu javamail? I would be interested if
my CA is still stored in some other keystore used by gnu javamail or if gnu
javamail has a problem.

Thanks

Carl

--089e01176915441ca904e85f29b4--