Hello,

While adapting 'mk-ca-bundle' to generate
separate PEM files for 'sendmail' I came
across a bug in the state-machine logic
that reads 'certdata.txt'.

The result is that the certificate

   Hellenic Academic and Research Institutions RootCA 2011

in the Firefox 15 version of 'certdata.txt'
was skipped. Didn't look at it too hard,
but it seems to me that worse outcomes
could result from the flaw.

I've attached my revised script, which
breaks PEM files out separately.
'openssl' presents all 156 CA cert
subjects in the TLS negotiation when a
'ca-bundle.pem' approach is taken. This
adds 25k to the TLS handshake--expensive.
With separate files hash-linked
by 'c_rehash', only the one or two
parent certificates included in
cacert.pem are presented during
TLS startup. Openssl version 1.0.1
was used.

It should be fairly easy to back the
loop-logic changes or something similar
into the original.

Regards

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html