subversion-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From s...@apache.org
Subject svn commit: r1630117 - in /subversion/trunk/subversion: include/svn_cmdline.h libsvn_subr/cmdline.c libsvn_subr/deprecated.c svn/cl.h svn/svn.c tests/cmdline/getopt_tests_data/svn_help_log_switch_stdout
Date Wed, 08 Oct 2014 14:22:40 GMT
Author: stsp
Date: Wed Oct  8 14:22:40 2014
New Revision: 1630117

URL: http://svn.apache.org/r1630117
Log:
For non-interactive mode, allow fine-grained control over which SSL
certificate failures are considered fatal and which may be ignored.

The --trust-server-cert option only accepts certificates signed by an
unknown CA, and rejects certificates which fail for other reasons.
However, in practice, people run into broken SSL configurations that
trigger other failure conditions such as hostname/CN mismatch, expired
certs, etc. Sometimes they are not in a position to fix the problem themselves
and can't get work done (writing scripts) since SVN refuses to operate.
This topic is one of the most discussed issues in the #svn IRC channel.
Somewhat less so on the users@ mailing lists, though it also occurs there.

There is no real reason to prefer one kind of failure condition over
any other. An invalid cert is an invalid cert, regardless of why it fails
validation. Ultimately, it is up to users to waive trust in SSL when it
gets in the way in a particular situation. We should not be making this
decision for them.

Deprecate the --trust-server-cert option and add the following new options
to 'svn', exposing all possible failure modes the underlying API can handle:

  --trust-unknown-ca       : with --non-interactive, accept SSL server
                             certificates from unknown certificate authorities
  --trust-cn-mismatch      : with --non-interactive, accept SSL server
                             certificates even if the server hostname does not
                             match the certificate's common name attribute
  --trust-expired          : with --non-interactive, accept expired SSL server
                             certificates
  --trust-not-yet-valid    : with --non-interactive, accept SSL server
                             certificates from the future
  --trust-other-failure    : with --non-interactive, accept SSL server
                             certificates with failures other than the above

* subversion/include/svn_cmdline.h
  (svn_cmdline_create_auth_baton2): Declare and document new parameters.
  (svn_cmdline_create_auth_baton): Deprecate.

* subversion/libsvn_subr/cmdline.c
  (trust_server_cert_non_interactive_baton): New baton.
  (ssl_trust_unknown_server_cert): Rename to ...
  (trust_server_cert_non_interactive): .. this and implement generic
   validation failure checks according to flags passed in baton.
  (svn_cmdline_create_auth_baton): Move to libsvn_subr/deprecated.c.
  (svn_cmdline_create_auth_baton2): Implement new revision of this API with
   new options trust_server_cert_unknown_ca, trust_server_cert_cn_mismatch,
   trust_server_cert_expired, trust_server_cert_not_yet_valid, and
   trust_server_cert_other_failure.

* subversion/libsvn_subr/deprecated.c
  (svn_cmdline_create_auth_baton): Implement as wrapper around
   svn_cmdline_create_auth_baton2.

* subversion/svn/cl.h
  (svn_cl__opt_state_t): Add new options trust_server_cert_unknown_ca,
   trust_server_cert_cn_mismatch, trust_server_cert_expired,
   trust_server_cert_not_yet_valid, and trust_server_cert_other_failure.
  .
* subversion/svn/svn.c
   (svn_cl__longopt_t): Add new options opt_trust_server_cert_unknown_ca,
    opt_trust_server_cert_cn_mismatch, opt_trust_server_cert_expired,
    opt_trust_server_cert_not_yet_valid, opt_trust_server_cert_other_failure.
   (svn_cl__options): Add options and help text for --trust-unknown-ca,
    --trust-cn-mismatch, --trust-expired, --trust-not-yet-valid, and
    --trust-other-failure.
   (svn_cl__global_options): Add the new options here.
   (sub_main): Process new options and use svn_cmdline_create_auth_baton2().
                         
* subversion/tests/cmdline/getopt_tests_data/svn_help_log_switch_stdout:
   Adjust expected output.

Modified:
    subversion/trunk/subversion/include/svn_cmdline.h
    subversion/trunk/subversion/libsvn_subr/cmdline.c
    subversion/trunk/subversion/libsvn_subr/deprecated.c
    subversion/trunk/subversion/svn/cl.h
    subversion/trunk/subversion/svn/svn.c
    subversion/trunk/subversion/tests/cmdline/getopt_tests_data/svn_help_log_switch_stdout

Modified: subversion/trunk/subversion/include/svn_cmdline.h
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/include/svn_cmdline.h?rev=1630117&r1=1630116&r2=1630117&view=diff
==============================================================================
--- subversion/trunk/subversion/include/svn_cmdline.h (original)
+++ subversion/trunk/subversion/include/svn_cmdline.h Wed Oct  8 14:22:40 2014
@@ -320,9 +320,29 @@ svn_cmdline_auth_plaintext_passphrase_pr
  * by the command line client.
  *
  * @a non_interactive, @a username, @a password, @a config_dir,
- * @a no_auth_cache, and @a trust_server_cert are the values of the
- * command line options of the corresponding names.
+ * and @a no_auth_cache are the values of the command line options
+ * of the corresponding names.
  *
+ * If @a non_interactive is @c TRUE, then the following parameters
+ * control whether an invalid SSL certificate will be accepted
+ * regardless of a specific verification failure:
+ *
+ * @a trust_server_cert_unknown_ca: If @c TRUE, accept certificates
+ * from unknown certificate authorities.
+ *
+ * @a trust_server_cert_cn_mismatch: If @c TRUE, accept certificates
+ * even if the Common Name attribute of the certificate differs from
+ * the hostname of the server.
+ *
+ * @a trust_server_cert_expired: If @c TRUE, accept certificates even
+ * if they are expired.
+ *
+ * @a trust_server_cert_not_yet_valid: If @c TRUE, accept certificates
+ * from the future.
+ *
+ * @a trust_server_cert_other_failure: If @c TRUE, accept certificates
+ * even if any other verification failure than the above occured.
+ * 
  * @a cfg is the @c SVN_CONFIG_CATEGORY_CONFIG configuration, and
  * @a cancel_func and @a cancel_baton control the cancellation of the
  * prompting providers that are initialized.
@@ -332,6 +352,29 @@ svn_cmdline_auth_plaintext_passphrase_pr
  * @since New in 1.6.
  */
 svn_error_t *
+svn_cmdline_create_auth_baton2(svn_auth_baton_t **ab,
+                               svn_boolean_t non_interactive,
+                               const char *username,
+                               const char *password,
+                               const char *config_dir,
+                               svn_boolean_t no_auth_cache,
+                               svn_boolean_t trust_server_cert_unknown_ca,
+                               svn_boolean_t trust_server_cert_cn_mismatch,
+                               svn_boolean_t trust_server_cert_expired,
+                               svn_boolean_t trust_server_cert_not_yet_valid,
+                               svn_boolean_t trust_server_cert_other_failure,
+                               svn_config_t *cfg,
+                               svn_cancel_func_t cancel_func,
+                               void *cancel_baton,
+                               apr_pool_t *pool);
+
+/* Like svn_cmdline_create_auth_baton2, but with only one trust_server_cert
+ * option which corresponds to trust_server_cert_unknown_ca.
+ * 
+ * @deprecated Provided for backward compatibility with the 1.8 API.
+ * @since New in 1.6.
+ */
+svn_error_t *
 svn_cmdline_create_auth_baton(svn_auth_baton_t **ab,
                               svn_boolean_t non_interactive,
                               const char *username,

Modified: subversion/trunk/subversion/libsvn_subr/cmdline.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_subr/cmdline.c?rev=1630117&r1=1630116&r2=1630117&view=diff
==============================================================================
--- subversion/trunk/subversion/libsvn_subr/cmdline.c (original)
+++ subversion/trunk/subversion/libsvn_subr/cmdline.c Wed Oct  8 14:22:40 2014
@@ -507,31 +507,50 @@ svn_cmdline_handle_exit_error(svn_error_
   return EXIT_FAILURE;
 }
 
+struct trust_server_cert_non_interactive_baton {
+  svn_boolean_t trust_server_cert_unknown_ca;
+  svn_boolean_t trust_server_cert_cn_mismatch;
+  svn_boolean_t trust_server_cert_expired;
+  svn_boolean_t trust_server_cert_not_yet_valid;
+  svn_boolean_t trust_server_cert_other_failure;
+};
+
 /* This implements 'svn_auth_ssl_server_trust_prompt_func_t'.
 
    Don't actually prompt.  Instead, set *CRED_P to valid credentials
-   iff FAILURES is empty or is exactly SVN_AUTH_SSL_UNKNOWNCA.  If
-   there are any other failure bits, then set *CRED_P to null (that
-   is, reject the cert).
+   iff FAILURES is empty or may be accepted according to the flags
+   in BATON. If there are any other failure bits, then set *CRED_P
+   to null (that is, reject the cert).
 
    Ignore MAY_SAVE; we don't save certs we never prompted for.
 
-   Ignore BATON, REALM, and CERT_INFO,
+   Ignore REALM and CERT_INFO,
 
    Ignore any further films by George Lucas. */
 static svn_error_t *
-ssl_trust_unknown_server_cert
-  (svn_auth_cred_ssl_server_trust_t **cred_p,
-   void *baton,
-   const char *realm,
-   apr_uint32_t failures,
-   const svn_auth_ssl_server_cert_info_t *cert_info,
-   svn_boolean_t may_save,
-   apr_pool_t *pool)
+trust_server_cert_non_interactive(svn_auth_cred_ssl_server_trust_t **cred_p,
+                                  void *baton,
+                                  const char *realm,
+                                  apr_uint32_t failures,
+                                  const svn_auth_ssl_server_cert_info_t
+                                    *cert_info,
+                                  svn_boolean_t may_save,
+                                  apr_pool_t *pool)
 {
+  struct trust_server_cert_non_interactive_baton *b = baton;
   *cred_p = NULL;
 
-  if (failures == 0 || failures == SVN_AUTH_SSL_UNKNOWNCA)
+  if (failures == 0 ||
+      (b->trust_server_cert_unknown_ca &&
+       (failures & SVN_AUTH_SSL_UNKNOWNCA)) ||
+      (b->trust_server_cert_cn_mismatch &&
+       (failures & SVN_AUTH_SSL_CNMISMATCH)) ||
+      (b->trust_server_cert_expired &&
+       (failures & SVN_AUTH_SSL_EXPIRED)) ||
+      (b->trust_server_cert_not_yet_valid &&
+        (failures & SVN_AUTH_SSL_NOTYETVALID)) ||
+      (b->trust_server_cert_other_failure &&
+        (failures & SVN_AUTH_SSL_OTHER)))
     {
       *cred_p = apr_pcalloc(pool, sizeof(**cred_p));
       (*cred_p)->may_save = FALSE;
@@ -542,17 +561,22 @@ ssl_trust_unknown_server_cert
 }
 
 svn_error_t *
-svn_cmdline_create_auth_baton(svn_auth_baton_t **ab,
-                              svn_boolean_t non_interactive,
-                              const char *auth_username,
-                              const char *auth_password,
-                              const char *config_dir,
-                              svn_boolean_t no_auth_cache,
-                              svn_boolean_t trust_server_cert,
-                              svn_config_t *cfg,
-                              svn_cancel_func_t cancel_func,
-                              void *cancel_baton,
-                              apr_pool_t *pool)
+svn_cmdline_create_auth_baton2(svn_auth_baton_t **ab,
+                               svn_boolean_t non_interactive,
+                               const char *auth_username,
+                               const char *auth_password,
+                               const char *config_dir,
+                               svn_boolean_t no_auth_cache,
+                               svn_boolean_t trust_server_cert_unknown_ca,
+                               svn_boolean_t trust_server_cert_cn_mismatch,
+                               svn_boolean_t trust_server_cert_expired,
+                               svn_boolean_t trust_server_cert_not_yet_valid,
+                               svn_boolean_t trust_server_cert_other_failure,
+                               svn_config_t *cfg,
+                               svn_cancel_func_t cancel_func,
+                               void *cancel_baton,
+                               apr_pool_t *pool)
+
 {
   svn_boolean_t store_password_val = TRUE;
   svn_boolean_t store_auth_creds_val = TRUE;
@@ -653,11 +677,22 @@ svn_cmdline_create_auth_baton(svn_auth_b
           APR_ARRAY_PUSH(providers, svn_auth_provider_object_t *) = provider;
         }
     }
-  else if (trust_server_cert)
-    {
+  else if (trust_server_cert_unknown_ca || trust_server_cert_cn_mismatch ||
+           trust_server_cert_expired || trust_server_cert_not_yet_valid ||
+           trust_server_cert_other_failure)
+    {
+      struct trust_server_cert_non_interactive_baton *b;
+
+      b = apr_palloc(pool, sizeof(*b));
+      b->trust_server_cert_unknown_ca = trust_server_cert_unknown_ca;
+      b->trust_server_cert_cn_mismatch = trust_server_cert_cn_mismatch;
+      b->trust_server_cert_expired = trust_server_cert_expired;
+      b->trust_server_cert_not_yet_valid = trust_server_cert_not_yet_valid;
+      b->trust_server_cert_other_failure = trust_server_cert_other_failure;
+
       /* Remember, only register this provider if non_interactive. */
       svn_auth_get_ssl_server_trust_prompt_provider
-        (&provider, ssl_trust_unknown_server_cert, NULL, pool);
+        (&provider, trust_server_cert_non_interactive, b, pool);
       APR_ARRAY_PUSH(providers, svn_auth_provider_object_t *) = provider;
     }
 

Modified: subversion/trunk/subversion/libsvn_subr/deprecated.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_subr/deprecated.c?rev=1630117&r1=1630116&r2=1630117&view=diff
==============================================================================
--- subversion/trunk/subversion/libsvn_subr/deprecated.c (original)
+++ subversion/trunk/subversion/libsvn_subr/deprecated.c Wed Oct  8 14:22:40 2014
@@ -1504,3 +1504,33 @@ svn_auth_get_gpg_agent_simple_provider(s
   svn_auth__get_gpg_agent_simple_provider(provider, pool);
 }
 #endif /* !WIN32 */
+
+svn_error_t *
+svn_cmdline_create_auth_baton(svn_auth_baton_t **ab,
+                              svn_boolean_t non_interactive,
+                              const char *auth_username,
+                              const char *auth_password,
+                              const char *config_dir,
+                              svn_boolean_t no_auth_cache,
+                              svn_boolean_t trust_server_cert,
+                              svn_config_t *cfg,
+                              svn_cancel_func_t cancel_func,
+                              void *cancel_baton,
+                              apr_pool_t *pool)
+{
+  return svn_error_trace(svn_cmdline_create_auth_baton2(ab,
+                                                        non_interactive,
+                                                        auth_username,
+                                                        auth_password,
+                                                        config_dir,
+                                                        no_auth_cache,
+                                                        trust_server_cert,
+                                                        FALSE,
+                                                        FALSE,
+                                                        FALSE,
+                                                        FALSE,
+                                                        cfg,
+                                                        cancel_func,
+                                                        cancel_baton,
+                                                        pool));
+}

Modified: subversion/trunk/subversion/svn/cl.h
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/svn/cl.h?rev=1630117&r1=1630116&r2=1630117&view=diff
==============================================================================
--- subversion/trunk/subversion/svn/cl.h (original)
+++ subversion/trunk/subversion/svn/cl.h Wed Oct  8 14:22:40 2014
@@ -227,8 +227,12 @@ typedef struct svn_cl__opt_state_t
   svn_cl__show_revs_t show_revs;   /* mergeinfo flavor */
   svn_depth_t set_depth;           /* new sticky ambient depth value */
   svn_boolean_t reintegrate;      /* use "reintegrate" merge-source heuristic */
-  svn_boolean_t trust_server_cert; /* trust server SSL certs that would
-                                      otherwise be rejected as "untrusted" */
+  /* trust server SSL certs that would otherwise be rejected as "untrusted" */
+  svn_boolean_t trust_server_cert_unknown_ca;
+  svn_boolean_t trust_server_cert_cn_mismatch;
+  svn_boolean_t trust_server_cert_expired;
+  svn_boolean_t trust_server_cert_not_yet_valid;
+  svn_boolean_t trust_server_cert_other_failure;
   int strip; /* number of leading path components to strip */
   svn_boolean_t ignore_keywords;   /* do not expand keywords */
   svn_boolean_t reverse_diff;      /* reverse a diff (e.g. when patching) */

Modified: subversion/trunk/subversion/svn/svn.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/svn/svn.c?rev=1630117&r1=1630116&r2=1630117&view=diff
==============================================================================
--- subversion/trunk/subversion/svn/svn.c (original)
+++ subversion/trunk/subversion/svn/svn.c Wed Oct  8 14:22:40 2014
@@ -125,6 +125,11 @@ typedef enum svn_cl__longopt_t {
   opt_show_revs,
   opt_reintegrate,
   opt_trust_server_cert,
+  opt_trust_server_cert_unknown_ca,
+  opt_trust_server_cert_cn_mismatch,
+  opt_trust_server_cert_expired,
+  opt_trust_server_cert_not_yet_valid,
+  opt_trust_server_cert_other_failure,
   opt_strip,
   opt_ignore_keywords,
   opt_reverse_diff,
@@ -236,11 +241,29 @@ const apr_getopt_option_t svn_cl__option
   {"no-auth-cache", opt_no_auth_cache, 0,
                     N_("do not cache authentication tokens")},
   {"trust-server-cert", opt_trust_server_cert, 0,
-                    N_("accept SSL server certificates from unknown\n"
+                    N_("deprecated; same as --trust-unknown-ca")},
+  {"trust-unknown-ca", opt_trust_server_cert_unknown_ca, 0,
+                    N_("with --non-interactive, accept SSL server\n"
                        "                             "
-                       "certificate authorities without prompting (but only\n"
+                       "certificates from unknown certificate authorities")},
+  {"trust-cn-mismatch", opt_trust_server_cert_cn_mismatch, 0,
+                    N_("with --non-interactive, accept SSL server\n"
                        "                             "
-                       "with '--non-interactive')") },
+                       "certificates even if the server hostname does not\n"
+                       "                             "
+                       "match the certificate's common name attribute")},
+  {"trust-expired", opt_trust_server_cert_expired, 0,
+                    N_("with --non-interactive, accept expired SSL server\n"
+                       "                             "
+                       "certificates")},
+  {"trust-not-yet-valid", opt_trust_server_cert_not_yet_valid, 0,
+                    N_("with --non-interactive, accept SSL server\n"
+                       "                             "
+                       "certificates from the future")},
+  {"trust-other-failure", opt_trust_server_cert_other_failure, 0,
+                    N_("with --non-interactive, accept SSL server\n"
+                       "                             "
+                       "certificates with failures other than the above")},
   {"non-interactive", opt_non_interactive, 0,
                     N_("do no interactive prompting (default is to prompt\n"
                        "                             "
@@ -427,8 +450,11 @@ const apr_getopt_option_t svn_cl__option
    willy-nilly to every invocation of 'svn') . */
 const int svn_cl__global_options[] =
 { opt_auth_username, opt_auth_password, opt_no_auth_cache, opt_non_interactive,
-  opt_force_interactive, opt_trust_server_cert, opt_config_dir,
-  opt_config_options, 0
+  opt_force_interactive, opt_trust_server_cert,
+  opt_trust_server_cert_unknown_ca, opt_trust_server_cert_cn_mismatch,
+  opt_trust_server_cert_expired, opt_trust_server_cert_not_yet_valid,
+  opt_trust_server_cert_other_failure,
+  opt_config_dir, opt_config_options, 0
 };
 
 /* Options for giving a log message.  (Some of these also have other uses.)
@@ -2124,8 +2150,21 @@ sub_main(int *exit_code, int argc, const
       case opt_force_interactive:
         force_interactive = TRUE;
         break;
-      case opt_trust_server_cert:
-        opt_state.trust_server_cert = TRUE;
+      case opt_trust_server_cert: /* backwards compat to 1.8 */
+      case opt_trust_server_cert_unknown_ca:
+        opt_state.trust_server_cert_unknown_ca = TRUE;
+        break;
+      case opt_trust_server_cert_cn_mismatch:
+        opt_state.trust_server_cert_cn_mismatch = TRUE;
+        break;
+      case opt_trust_server_cert_expired:
+        opt_state.trust_server_cert_expired = TRUE;
+        break;
+      case opt_trust_server_cert_not_yet_valid:
+        opt_state.trust_server_cert_not_yet_valid = TRUE;
+        break;
+      case opt_trust_server_cert_other_failure:
+        opt_state.trust_server_cert_other_failure = TRUE;
         break;
       case opt_no_diff_added:
         opt_state.diff.no_diff_added = TRUE;
@@ -2551,12 +2590,29 @@ sub_main(int *exit_code, int argc, const
                                 "are mutually exclusive"));
     }
 
-  /* --trust-server-cert can only be used with --non-interactive */
-  if (opt_state.trust_server_cert && !opt_state.non_interactive)
+  /* --trust-* options can only be used with --non-interactive */
+  if (!opt_state.non_interactive)
     {
-      return svn_error_create(SVN_ERR_CL_ARG_PARSING_ERROR, NULL,
-                              _("--trust-server-cert requires "
-                                "--non-interactive"));
+      if (opt_state.trust_server_cert_unknown_ca)
+        return svn_error_create(SVN_ERR_CL_ARG_PARSING_ERROR, NULL,
+                                _("--trust-unknown-ca requires "
+                                  "--non-interactive"));
+      if (opt_state.trust_server_cert_cn_mismatch)
+        return svn_error_create(SVN_ERR_CL_ARG_PARSING_ERROR, NULL,
+                                _("--trust-cn-mismatch requires "
+                                  "--non-interactive"));
+      if (opt_state.trust_server_cert_expired)
+        return svn_error_create(SVN_ERR_CL_ARG_PARSING_ERROR, NULL,
+                                _("--trust-expired requires "
+                                  "--non-interactive"));
+      if (opt_state.trust_server_cert_not_yet_valid)
+        return svn_error_create(SVN_ERR_CL_ARG_PARSING_ERROR, NULL,
+                                _("--trust-not-yet-valid requires "
+                                  "--non-interactive"));
+      if (opt_state.trust_server_cert_other_failure)
+        return svn_error_create(SVN_ERR_CL_ARG_PARSING_ERROR, NULL,
+                                _("--trust-other-failure requires "
+                                  "--non-interactive"));
     }
 
   /* Disallow simultaneous use of both --diff-cmd and
@@ -2874,17 +2930,22 @@ sub_main(int *exit_code, int argc, const
 #endif
 
   /* Set up Authentication stuff. */
-  SVN_ERR(svn_cmdline_create_auth_baton(&ab,
-                                        opt_state.non_interactive,
-                                        opt_state.auth_username,
-                                        opt_state.auth_password,
-                                        opt_state.config_dir,
-                                        opt_state.no_auth_cache,
-                                        opt_state.trust_server_cert,
-                                        cfg_config,
-                                        ctx->cancel_func,
-                                        ctx->cancel_baton,
-                                        pool));
+  SVN_ERR(svn_cmdline_create_auth_baton2(
+            &ab,
+            opt_state.non_interactive,
+            opt_state.auth_username,
+            opt_state.auth_password,
+            opt_state.config_dir,
+            opt_state.no_auth_cache,
+            opt_state.trust_server_cert_unknown_ca,
+            opt_state.trust_server_cert_cn_mismatch,
+            opt_state.trust_server_cert_expired,
+            opt_state.trust_server_cert_not_yet_valid,
+            opt_state.trust_server_cert_other_failure,
+            cfg_config,
+            ctx->cancel_func,
+            ctx->cancel_baton,
+            pool));
 
   ctx->auth_baton = ab;
 

Modified: subversion/trunk/subversion/tests/cmdline/getopt_tests_data/svn_help_log_switch_stdout
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/tests/cmdline/getopt_tests_data/svn_help_log_switch_stdout?rev=1630117&r1=1630116&r2=1630117&view=diff
==============================================================================
--- subversion/trunk/subversion/tests/cmdline/getopt_tests_data/svn_help_log_switch_stdout
(original)
+++ subversion/trunk/subversion/tests/cmdline/getopt_tests_data/svn_help_log_switch_stdout
Wed Oct  8 14:22:40 2014
@@ -122,9 +122,18 @@ Global options:
                              only if standard input is a terminal device)
   --force-interactive      : do interactive prompting even if standard input
                              is not a terminal device
-  --trust-server-cert      : accept SSL server certificates from unknown
-                             certificate authorities without prompting (but only
-                             with '--non-interactive')
+  --trust-server-cert      : deprecated; same as --trust-unknown-ca
+  --trust-unknown-ca       : with --non-interactive, accept SSL server
+                             certificates from unknown certificate authorities
+  --trust-cn-mismatch      : with --non-interactive, accept SSL server
+                             certificates even if the server hostname does not
+                             match the certificate's common name attribute
+  --trust-expired          : with --non-interactive, accept expired SSL server
+                             certificates
+  --trust-not-yet-valid    : with --non-interactive, accept SSL server
+                             certificates from the future
+  --trust-other-failure    : with --non-interactive, accept SSL server
+                             certificates with failures other than the above
   --config-dir ARG         : read user configuration files from directory ARG
   --config-option ARG      : set user configuration option in the format:
                                  FILE:SECTION:OPTION=[VALUE]
@@ -206,9 +215,18 @@ Global options:
                              only if standard input is a terminal device)
   --force-interactive      : do interactive prompting even if standard input
                              is not a terminal device
-  --trust-server-cert      : accept SSL server certificates from unknown
-                             certificate authorities without prompting (but only
-                             with '--non-interactive')
+  --trust-server-cert      : deprecated; same as --trust-unknown-ca
+  --trust-unknown-ca       : with --non-interactive, accept SSL server
+                             certificates from unknown certificate authorities
+  --trust-cn-mismatch      : with --non-interactive, accept SSL server
+                             certificates even if the server hostname does not
+                             match the certificate's common name attribute
+  --trust-expired          : with --non-interactive, accept expired SSL server
+                             certificates
+  --trust-not-yet-valid    : with --non-interactive, accept SSL server
+                             certificates from the future
+  --trust-other-failure    : with --non-interactive, accept SSL server
+                             certificates with failures other than the above
   --config-dir ARG         : read user configuration files from directory ARG
   --config-option ARG      : set user configuration option in the format:
                                  FILE:SECTION:OPTION=[VALUE]



Mime
View raw message