Determining SSL Authenticity - Part III

[Dave Cragg]

On 3 Jan 2007, at 16:50, Derek Bump wrote:

>
>   1. Internet Explorer comes preloaded with Certificates.
>
>   2. Runtime Revolution does not come preloaded with Certificates.
>
> On this basis, if I utilize the following command...
>
>   open secure socket to "whatever.com" with message "openedOK"
>
> ... Revolution will return back some sort of error because  
> Revolution cannot access the Certificates that are pre-installed  
> with Internet Explorer,

I always forget that part. :-)

Once upon a time, there was a ".pem" file that was distributed with  
Rev (perhaps only distributed in an alpha/beta version when secure  
sockets were first introduced). Setting the sslcertificates property  
to this file would allow Rev to handle the certificate  
authentication. I can't find that file on the machine I'm at at the  
moment, but I seem to remember it no longer worked when I last tried  
it. But you may be able to find a suitable file somewhere that can be  
used. Perhaps someone else can help.

> meanwhile IE will validate the certificate and return an "OK"  
> result (provided it is OK).

>
> On the other hand, if IE encounters a bad or unknown certificate,  
> then some sort of error message will come up anyways.  IE will  
> automatically take care of the issue and lead the user where they  
> need to go.

A reasonable assumption, I think.

Cheers
Dave