A Writeable Gemini

[Mansfield]

On Wed, Nov 10, 2021 at 4:19 AM Omar Polo <op@omarpolo.com> wrote:

>
> Mansfield <mansfield@ondollo.com> writes:
>
> > On Tue, Nov 9, 2021 at 6:46 PM Mansfield <mansfield@ondollo.com> wrote:
> >
> >  On Tue, Nov 9, 2021 at 2:16 AM Balázs Botond <balazsbotond@gmail.com>
> wrote:
> >
> >  Hi,
> >
> >  On Tue, Nov 9, 2021 at 2:39 AM Mansfield <mansfield@ondollo.com> wrote:
> >  > My limited response:
> >  >    gemini://ondollo.com/~/mansfield/A Writeable Gemini.gem
> >
> >  There's a problem with the certificate at ondollo.com so your link
> doesn't work.
> >
> >  Botond
> >
> >  Oh... interesting... the classic "works for me"... well, here's the
> cert from the Mozz proxies perspective:
> >
> >  https://portal.mozz.us/gemini/ondollo.com?crt=1
> >
> >  I wonder what's wrong with it? Mozz doesn't load the site either...
> >
> >  I guess I gave a poor link as well... the spaces weren't encoded. Does
> this link work for you?
> >  gemini://ondollo.com/~/mansfield/A%20Writeable%20Gemini.gem
> >
> > I tweaked the server to accept connections that don't provide a cert -
> seems to have turned the Mozz close_notify red x to a green
> > checkmark.
> >
> > Maybe now things will work better for you (and others with similar
> clients, no doubt).
> >
> > Many thanks for letting me know that that was broken!
>
> It's still broken unfortunately.  While it's true that the certificate
> doesn't include the domain name:
>
> % printf 'gemini://ondollo.com\r\n' | nc -Tnoverify -c ondollo.com 1965
> nc: tls handshake failed (name `ondollo.com' not present in server
> certificate)
>
> even if I throw a -noname at it (which disables the certificate name
> checking) the reply is still empty :/
>
> % printf 'gemini://ondollo.com\r\n' | nc -Tnoverify -Tnoname -c
> ondollo.com 1965
> % echo $?
> 0
>
>
Well, thanks for all the responses - turns out I had a few bits that needed
adjusting beyond the common_name one.

For anyone else caught in a tls debug process and wanting an easy way to
test their server, I ended up using a command like this:

```
echo -e "/\r\n" | openssl s_client -crlf -connect domain.tld:1965 -ign_eof
```

That command alone won't get you all the way there, but it could help. It
also helps that Gemini clients tend to not be complicated to get going with.

Hopefully everything is accessible now!