xp-framework/xp-framework — pull request #209 by kiesel (2012-11-27 10:05:57+00:00)
Title: By default require SSL connections to be encrypted *and* authenticated

If only using encryption MITM attacks are easily possible, so the framework's default should be changed.

However, this pull requests first serves as a discussion playground for this: to verify a peer certificate, one needs to have a list of trusted root CAs. If missing, no peer certificate will be accepted. The list can change over time, though, so bundling it with the framework is not a good option.

It should be best to use the list of CAs from the system, but there is probably no portable way of finding them. Maybe someone has any insights to this.

On cygwin, there's a bundle of certs here:

```sh
-> % ls /usr/ssl/certs
README.RootCerts ca-bundle.crt ca-bundle.trust.crt demo expired
```

On gentoo, it is here (another - probably more suitable format):

```sh
-> % ls -1l /etc/ssl/certs
total 1012
lrwxrwxrwx 1 root root 29 Jun 11 08:49 024dc131.0 -> Microsec_e-Szigno_Root_CA.pem
lrwxrwxrwx 1 root root 50 Jun 11 08:49 039c618a.0 -> TURKTRUST_Certificate_Services_Provider_Root_2.pem
...
```

On debian, it seems to be the same directory & format.