sslcacertfile troubleshooting :)

[Daniel Shahaf]

SamLT wrote on Wed, Jan 18, 2012 at 13:33:51 +0100:
> On Wed, Jan 18, 2012 at 01:49:02PM +0200, Daniel Shahaf wrote:
> > SamLT wrote on Wed, Jan 18, 2012 at 12:00:32 +0100:
> > > openssl to generate the sslcacertfile, since 1) s_client doesn't
> > > support IPv6,
> > 
> > That's false.
> 
> Really? Well, I just noticed that this morning while trying to
> understand what was going on. "s_client", here, certainly doesn't try
> AAAA dns lookup by default, doesn't accept any -4 or -6 switch nor an
> IPv6 address when specified manually. After looking on the web, I
> read there has been many patch to add that "functionnality", but, I
> haven't found one that has been accepted.
> 
> I'm currently using openssl 1.0.0.f which isn't an old version. So, I
> admit I haven't dig deeper then that, but hopefully you're going to
> enlighten me.

1. OpenSSL 1.0.0something on OpenBSD supports IPv6 in -connect,-4,-6.

2. OpenSSL 1.0.0something on a non-IPv6-enabled Ubuntu host doesn't.

3. I haven't checked upstream sources.  I'd be negatively surprised if
they don't support IPv6.