lobo/isync
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

unbreak CertificateFile documentation

Browse Source 
the file may in fact contain CA certs.

amends 7d9d3e15.
This commit is contained in:
Oswald Buddenhagen 2020-08-02 20:05:42 +02:00
parent 80deabf520
commit 09540b5648
1 changed files with 20 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
src/mbsync.1
View File

@ -379,17 +379,27 @@ if you want to trust only hand-picked certificates.
\fBCertificateFile\fR \fIpath\fR \fBCertificateFile\fR \fIpath\fR
File containing additional X.509 certificates used to verify server File containing additional X.509 certificates used to verify server
identities. identities.
These certificates are always trusted, regardless of validity. It may contain two types of certificates:
.RS
.IP Host
These certificates are matched only against the received server certificate
itself.
They are always trusted, regardless of validity.
A typical use case would be forcing acceptance of an expired certificate.
.br .br
The certificates from this file are matched only against the received These certificates may be obtained using the \fBmbsync-get-cert\fR tool;
server certificate itself; CA certificates are \fBnot\fR supported here. make sure to verify their fingerprints before trusting them, or transfer
Do \fBnot\fR specify the system's CA certificate store here; see them securely from the server's network (if it can be trusted beyond the
\fBSystemCertificates\fR instead. server itself).
.br .IP CA
The contents for this file may be obtained using the These certificates are used as trust anchors when building the certificate
\fBmbsync-get-cert\fR tool; make sure to verify the fingerprints of the chain for the received server certificate.
certificates before trusting them, or transfer them securely from the They are used to supplant or supersede the system's trust store, depending
server's network (if it is trusted). on the \fBSystemCertificates\fR setting;
it is not necessary and not recommended to specify the system's trust store
itself here.
The trust chains are fully validated.
.RE
. .
.TP .TP
\fBClientCertificate\fR \fIpath\fR \fBClientCertificate\fR \fIpath\fR