Re: [fetchmail-devel] Assorted minor bugs

[Brian C. <B.C...@po...>]

> A second step (longer-term than the next release), i. e. after the next
> official release, should then make strict checking the default and offer
> the user options to relax checking for the case when the configuration
> (client or server) cannot be fixed on short notice.

I agree, except that if you specify an explicit fingerprint that should also
make the certificate checking non-strict.

That is, if you *know* the public key of the end-point you're talking to,
then you don't care if it has been signed or by whom or when. With
--sslfingerprint you're effectively using the ssh model, rather than the ssl
model, for preventing man-in-the-middle attacks.

Regards,

Brian.