Expand description
Telnet over TLS (“TelnetS”, usually port 992), on rustls with the same ring crypto as SSH.
A certificate is first checked against the web’s certificate authorities
(the Mozilla roots in webpki-roots). Many BBSes use self-signed
certificates, so one that fails that check is trusted on first use and
pinned by its SHA-256 fingerprint in tls_known_hosts, like SSH host
keys; a later, different certificate is refused. A system once verified
by an authority is remembered as such, so it cannot later be passed off
with a self-signed certificate.
Functions§
- check_
pin - Decide on a certificate with this
fingerprint, which a certificate authority vouched for (ca_ok) or not, and update the pins. Returns a notice for the user when something new was trusted, or why the certificate is refused.