diff doc/hgrc.5.txt @ 13314:8dc488dfcdb4 stable

url: 'ssh known host'-like checking of fingerprints of HTTPS certificates

Known fingerprints of HTTPS servers can now be configured in the
hostfingerprints section. That makes it possible to verify the identify of web
servers without configuring and trusting the CA chain.

Limitations:
* Portnumbers are ignored, just like with ordinary certificates.
* Host name matching is case sensitive.

--- a/doc/hgrc.5.txt	Thu Jan 27 17:21:23 2011 -0600
+++ b/doc/hgrc.5.txt	Fri Jan 28 02:57:59 2011 +0100
@@ -423,6 +423,24 @@
   myfeature = ~/.hgext/myfeature.py
 
 
+``hostfingerprints``
+""""""""""""""""""""
+
+Fingerprints of the certificates of known HTTPS servers.
+A HTTPS connection to a server with a fingerprint configured here will
+only succeed if the servers certificate matches the fingerprint.
+This is very similar to how ssh known hosts works.
+The fingerprint is the SHA-1 hash value of the DER encoded certificate.
+The CA chain and web.cacerts is not used for servers with a fingerprint.
+
+For example::
+
+    [hostfingerprints]
+    hg.intevation.org = 38:76:52:7c:87:26:9a:8f:4a:f8:d3:de:08:45:3b:ea:d6:4b:ee:cc
+
+This feature is only supported when using Python 2.6 or later.
+
+
 ``format``
 """"""""""