Just to clarify things here, ssl does establish a secure connection, no
doubt about that. What we're talking about here is certainty of
authentication of the remote host. You really can never be 100% certain
about this authentication because there are any number of ways here that the
remote host could have been compromised. Without using CA information to
verify the remote host, you cannot actually verify him because you have no
root certificates to authenticate his certificates. You could resolve the
spoofed server problem by checking to see if the only problem with the
certificates would have been the fact that you can't verify the root
certificate.

-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone? Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
Received on 2002-08-19