src/gtk/sslcertwindow.c

   1 /*
   2  * Claws Mail -- a GTK+ based, lightweight, and fast e-mail client
   3  * Copyright (C) 1999-2016 Colin Leroy <colin@colino.net>
   4  * and the Claws Mail team
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #ifdef HAVE_CONFIG_H
  22 #  include "config.h"
  23 #include "claws-features.h"
  24 #endif
  25
  26 #ifdef USE_GNUTLS
  27
  28 #include <gnutls/gnutls.h>
  29 #include <gnutls/x509.h>
  30 #include <sys/types.h>
  31 #include <sys/stat.h>
  32 #include <stdio.h>
  33 #include <unistd.h>
  34 #include <string.h>
  35
  36 #include <glib.h>
  37 #include <glib/gi18n.h>
  38 #include <gtk/gtk.h>
  39
  40 #include "prefs_common.h"
  41 #include "defs.h"
  42 #include "ssl_certificate.h"
  43 #include "utils.h"
  44 #include "alertpanel.h"
  45 #include "hooks.h"
  46
  47 static gboolean sslcertwindow_ask_new_cert(SSLCertificate *cert);
  48 static gboolean sslcertwindow_ask_expired_cert(SSLCertificate *cert);
  49 static gboolean sslcertwindow_ask_changed_cert(SSLCertificate *old_cert, SSLCertificate *new_cert);
  50
  51 static GtkWidget *cert_presenter(SSLCertificate *cert)
  52 {
  53         GtkWidget *vbox = NULL;
  54         GtkWidget *hbox = NULL;
  55         GtkWidget *frame_owner = NULL;
  56         GtkWidget *frame_signer = NULL;
  57         GtkWidget *frame_status = NULL;
  58         GtkTable *owner_table = NULL;
  59         GtkTable *signer_table = NULL;
  60         GtkTable *status_table = NULL;
  61         GtkWidget *label = NULL;
  62
  63         char *issuer_commonname, *issuer_location, *issuer_organization;
  64         char *subject_commonname, *subject_location, *subject_organization;
  65         char *sig_status, *exp_date;
  66         char *sha1_fingerprint, *sha256_fingerprint, *fingerprint;
  67         size_t n;
  68         char buf[100];
  69         unsigned char md[128];
  70         char *tmp;
  71         time_t exp_time_t;
  72         struct tm lt;
  73
  74         /* issuer */
  75         issuer_commonname = g_malloc(BUFFSIZE);
  76         issuer_location = g_malloc(BUFFSIZE);
  77         issuer_organization = g_malloc(BUFFSIZE);
  78         subject_commonname = g_malloc(BUFFSIZE);
  79         subject_location = g_malloc(BUFFSIZE);
  80         subject_organization = g_malloc(BUFFSIZE);
  81
  82         n = BUFFSIZE;
  83         if (gnutls_x509_crt_get_issuer_dn_by_oid(cert->x509_cert,
  84                 GNUTLS_OID_X520_COMMON_NAME, 0, 0, issuer_commonname, &n))
  85                 strncpy(issuer_commonname, _("<not in certificate>"), BUFFSIZE);
  86         n = BUFFSIZE;
  87
  88         if (gnutls_x509_crt_get_issuer_dn_by_oid(cert->x509_cert,
  89                 GNUTLS_OID_X520_LOCALITY_NAME, 0, 0, issuer_location, &n)) {
  90                 if (gnutls_x509_crt_get_issuer_dn_by_oid(cert->x509_cert,
  91                         GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, issuer_location, &n)) {
  92                         strncpy(issuer_location, _("<not in certificate>"), BUFFSIZE);
  93                 }
  94         } else {
  95                 tmp = g_malloc(BUFFSIZE);
  96                 if (gnutls_x509_crt_get_issuer_dn_by_oid(cert->x509_cert,
  97                         GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, tmp, &n) == 0) {
  98                         strncat(issuer_location, ", ", BUFFSIZE-strlen(issuer_location)-1);
  99                         strncat(issuer_location, tmp, BUFFSIZE-strlen(issuer_location)-1);
 100                 }
 101                 g_free(tmp);
 102         }
 103
 104         n = BUFFSIZE;
 105         if (gnutls_x509_crt_get_issuer_dn_by_oid(cert->x509_cert,
 106                 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, 0, issuer_organization, &n))
 107                 strncpy(issuer_organization, _("<not in certificate>"), BUFFSIZE);
 108
 109         n = BUFFSIZE;
 110         if (gnutls_x509_crt_get_dn_by_oid(cert->x509_cert,
 111                 GNUTLS_OID_X520_COMMON_NAME, 0, 0, subject_commonname, &n))
 112                 strncpy(subject_commonname, _("<not in certificate>"), BUFFSIZE);
 113         n = BUFFSIZE;
 114
 115         if (gnutls_x509_crt_get_dn_by_oid(cert->x509_cert,
 116                 GNUTLS_OID_X520_LOCALITY_NAME, 0, 0, subject_location, &n)) {
 117                 if (gnutls_x509_crt_get_dn_by_oid(cert->x509_cert,
 118                         GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, subject_location, &n)) {
 119                         strncpy(subject_location, _("<not in certificate>"), BUFFSIZE);
 120                 }
 121         } else {
 122                 tmp = g_malloc(BUFFSIZE);
 123                 if (gnutls_x509_crt_get_dn_by_oid(cert->x509_cert,
 124                         GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, tmp, &n) == 0) {
 125                         strncat(subject_location, ", ", BUFFSIZE-strlen(subject_location)-1);
 126                         strncat(subject_location, tmp, BUFFSIZE-strlen(subject_location)-1);
 127                 }
 128                 g_free(tmp);
 129         }
 130
 131         n = BUFFSIZE;
 132         if (gnutls_x509_crt_get_dn_by_oid(cert->x509_cert,
 133                 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, 0, subject_organization, &n))
 134                 strncpy(subject_organization, _("<not in certificate>"), BUFFSIZE);
 135
 136         exp_time_t = gnutls_x509_crt_get_expiration_time(cert->x509_cert);
 137
 138         memset(buf, 0, sizeof(buf));
 139         if (exp_time_t > 0) {
 140                 fast_strftime(buf, sizeof(buf)-1, prefs_common.date_format, localtime_r(&exp_time_t, &lt));
 141                 exp_date = (*buf) ? g_strdup(buf):g_strdup("?");
 142         } else
 143                 exp_date = g_strdup("");
 144
 145         /* fingerprint */
 146         n = 128;
 147         gnutls_x509_crt_get_fingerprint(cert->x509_cert, GNUTLS_DIG_SHA1, md, &n);
 148         sha1_fingerprint = readable_fingerprint(md, (int)n);
 149         gnutls_x509_crt_get_fingerprint(cert->x509_cert, GNUTLS_DIG_SHA256, md, &n);
 150         sha256_fingerprint = readable_fingerprint(md, (int)n);
 151
 152
 153         /* signature */
 154         sig_status = ssl_certificate_check_signer(cert, cert->status);
 155
 156         if (sig_status==NULL)
 157                 sig_status = g_strdup_printf(_("Correct%s"),exp_time_t < time(NULL)? _(" (expired)"): "");
 158         else if (exp_time_t < time(NULL))
 159                           sig_status = g_strconcat(sig_status,_(" (expired)"),NULL);
 160
 161         vbox = gtk_vbox_new(FALSE, 5);
 162         hbox = gtk_hbox_new(FALSE, 5);
 163
 164         frame_owner  = gtk_frame_new(_("Owner"));
 165         frame_signer = gtk_frame_new(_("Signer"));
 166         frame_status = gtk_frame_new(_("Status"));
 167
 168         owner_table = GTK_TABLE(gtk_table_new(3, 2, FALSE));
 169         signer_table = GTK_TABLE(gtk_table_new(3, 2, FALSE));
 170         status_table = GTK_TABLE(gtk_table_new(3, 2, FALSE));
 171
 172         label = gtk_label_new(_("Name: "));
 173         gtk_misc_set_alignment (GTK_MISC (label), 1, 0.5);
 174         gtk_table_attach(owner_table, label, 0, 1, 0, 1, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 175         label = gtk_label_new(subject_commonname);
 176         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 177         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 178         gtk_table_attach(owner_table, label, 1, 2, 0, 1, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 179
 180         label = gtk_label_new(_("Organization: "));
 181         gtk_misc_set_alignment (GTK_MISC (label), 1, 0.5);
 182         gtk_table_attach(owner_table, label, 0, 1, 1, 2, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 183         label = gtk_label_new(subject_organization);
 184         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 185         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 186         gtk_table_attach(owner_table, label, 1, 2, 1, 2, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 187
 188         label = gtk_label_new(_("Location: "));
 189         gtk_misc_set_alignment (GTK_MISC (label), 1, 0.5);
 190         gtk_table_attach(owner_table, label, 0, 1, 2, 3, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 191         label = gtk_label_new(subject_location);
 192         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 193         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 194         gtk_table_attach(owner_table, label, 1, 2, 2, 3, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 195
 196         label = gtk_label_new(_("Name: "));
 197         gtk_misc_set_alignment (GTK_MISC (label), 1, 0.5);
 198         gtk_table_attach(signer_table, label, 0, 1, 0, 1, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 199         label = gtk_label_new(issuer_commonname);
 200         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 201         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 202         gtk_table_attach(signer_table, label, 1, 2, 0, 1, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 203
 204         label = gtk_label_new(_("Organization: "));
 205         gtk_misc_set_alignment (GTK_MISC (label), 1, 0.5);
 206         gtk_table_attach(signer_table, label, 0, 1, 1, 2, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 207         label = gtk_label_new(issuer_organization);
 208         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 209         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 210         gtk_table_attach(signer_table, label, 1, 2, 1, 2, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 211
 212         label = gtk_label_new(_("Location: "));
 213         gtk_misc_set_alignment (GTK_MISC (label), 1, 0.5);
 214         gtk_table_attach(signer_table, label, 0, 1, 2, 3, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 215         label = gtk_label_new(issuer_location);
 216         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 217         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 218         gtk_table_attach(signer_table, label, 1, 2, 2, 3, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 219
 220         label = gtk_label_new(_("Fingerprint: \n"));
 221         gtk_misc_set_alignment (GTK_MISC (label), 1, 0.5);
 222         gtk_table_attach(status_table, label, 0, 1, 0, 1, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 223         fingerprint = g_strdup_printf("SHA1: %s\nSHA256: %s",
 224                                       sha1_fingerprint, sha256_fingerprint);
 225         label = gtk_label_new(fingerprint);
 226         g_free(fingerprint);
 227         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 228         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 229         gtk_table_attach(status_table, label, 1, 2, 0, 1, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 230         label = gtk_label_new(_("Signature status: "));
 231         gtk_misc_set_alignment (GTK_MISC (label), 1, 0.5);
 232         gtk_table_attach(status_table, label, 0, 1, 1, 2, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 233         label = gtk_label_new(sig_status);
 234         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 235         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 236         gtk_table_attach(status_table, label, 1, 2, 1, 2, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 237         label = gtk_label_new(exp_time_t < time(NULL)? _("Expired on: "): _("Expires on: "));
 238         gtk_misc_set_alignment (GTK_MISC (label), 1, 0.5);
 239         gtk_table_attach(status_table, label, 0, 1, 2, 3, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 240         label = gtk_label_new(exp_date);
 241         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 242         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 243         gtk_table_attach(status_table, label, 1, 2, 2, 3, GTK_EXPAND|GTK_FILL, 0, 0, 0);
 244
 245         gtk_container_add(GTK_CONTAINER(frame_owner), GTK_WIDGET(owner_table));
 246         gtk_container_add(GTK_CONTAINER(frame_signer), GTK_WIDGET(signer_table));
 247         gtk_container_add(GTK_CONTAINER(frame_status), GTK_WIDGET(status_table));
 248
 249         gtk_box_pack_end(GTK_BOX(hbox), frame_signer, TRUE, TRUE, 0);
 250         gtk_box_pack_end(GTK_BOX(hbox), frame_owner, TRUE, TRUE, 0);
 251         gtk_box_pack_end(GTK_BOX(vbox), frame_status, TRUE, TRUE, 0);
 252         gtk_box_pack_end(GTK_BOX(vbox), hbox, TRUE, TRUE, 0);
 253
 254         gtk_widget_show_all(vbox);
 255
 256         g_free(issuer_commonname);
 257         g_free(issuer_location);
 258         g_free(issuer_organization);
 259         g_free(subject_commonname);
 260         g_free(subject_location);
 261         g_free(subject_organization);
 262         g_free(sha1_fingerprint);
 263         g_free(sha256_fingerprint);
 264         g_free(sig_status);
 265         g_free(exp_date);
 266         return vbox;
 267 }
 268
 269 static gboolean sslcert_ask_hook(gpointer source, gpointer data)
 270 {
 271         SSLCertHookData *hookdata = (SSLCertHookData *)source;
 272
 273         if (hookdata == NULL) {
 274                 return FALSE;
 275         }
 276
 277         if (prefs_common.skip_ssl_cert_check) {
 278                 hookdata->accept = TRUE;
 279                 return TRUE;
 280         }
 281
 282         if (hookdata->old_cert == NULL) {
 283                 if (hookdata->expired)
 284                         hookdata->accept = sslcertwindow_ask_expired_cert(hookdata->cert);
 285                 else
 286                         hookdata->accept = sslcertwindow_ask_new_cert(hookdata->cert);
 287         } else {
 288                 hookdata->accept = sslcertwindow_ask_changed_cert(hookdata->old_cert, hookdata->cert);
 289         }
 290
 291         return TRUE;
 292 }
 293
 294 void sslcertwindow_register_hook(void)
 295 {
 296         hooks_register_hook(SSLCERT_ASK_HOOKLIST, sslcert_ask_hook, NULL);
 297 }
 298
 299 void sslcertwindow_show_cert(SSLCertificate *cert)
 300 {
 301         GtkWidget *cert_widget = cert_presenter(cert);
 302         gchar *buf;
 303
 304         buf = g_strdup_printf(_("SSL/TLS certificate for %s"), cert->host);
 305         alertpanel_full(buf, NULL, GTK_STOCK_CLOSE, NULL, NULL,
 306                         ALERTFOCUS_FIRST, FALSE, cert_widget, ALERT_NOTICE);
 307         g_free(buf);
 308 }
 309
 310 static gchar *sslcertwindow_get_invalid_str(SSLCertificate *cert)
 311 {
 312         gchar *subject_cn = NULL;
 313         gchar *str = NULL;
 314
 315         if (ssl_certificate_check_subject_cn(cert))
 316                 return g_strdup("");
 317
 318         subject_cn = ssl_certificate_get_subject_cn(cert);
 319
 320         str = g_strdup_printf(_("Certificate is for %s, but connection is to %s.\n"
 321                                 "You may be connecting to a rogue server.\n\n"),
 322                                 subject_cn, cert->host);
 323         g_free(subject_cn);
 324
 325         return str;
 326 }
 327
 328 static gboolean sslcertwindow_ask_new_cert(SSLCertificate *cert)
 329 {
 330         gchar *buf, *sig_status;
 331         AlertValue val;
 332         GtkWidget *vbox;
 333         GtkWidget *label;
 334         GtkWidget *button;
 335         GtkWidget *cert_widget;
 336         gchar *invalid_str = sslcertwindow_get_invalid_str(cert);
 337         const gchar *title;
 338
 339         vbox = gtk_vbox_new(FALSE, 5);
 340         buf = g_strdup_printf(_("Certificate for %s is unknown.\n%sDo you want to accept it?"), cert->host, invalid_str);
 341         g_free(invalid_str);
 342
 343         label = gtk_label_new(buf);
 344         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 345         gtk_box_pack_start(GTK_BOX(vbox), label, TRUE, TRUE, 0);
 346         g_free(buf);
 347
 348         sig_status = ssl_certificate_check_signer(cert, cert->status);
 349         if (sig_status==NULL)
 350                 sig_status = g_strdup(_("Correct"));
 351
 352         buf = g_strdup_printf(_("Signature status: %s"), sig_status);
 353         label = gtk_label_new(buf);
 354         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 355         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 356         gtk_box_pack_start(GTK_BOX(vbox), label, TRUE, TRUE, 0);
 357         g_free(buf);
 358         g_free(sig_status);
 359
 360         button = gtk_expander_new_with_mnemonic(_("_View certificate"));
 361         gtk_box_pack_start(GTK_BOX(vbox), button, FALSE, FALSE, 0);
 362         cert_widget = cert_presenter(cert);
 363         gtk_container_add(GTK_CONTAINER(button), cert_widget);
 364
 365         if (!ssl_certificate_check_subject_cn(cert))
 366                 title = _("SSL/TLS certificate is invalid");
 367         else
 368                 title = _("SSL/TLS certificate is unknown");
 369
 370         val = alertpanel_full(title, NULL,
 371                               _("_Cancel connection"), _("_Accept and save"), NULL,
 372                               ALERTFOCUS_FIRST, FALSE, vbox, ALERT_QUESTION);
 373
 374         return (val == G_ALERTALTERNATE);
 375 }
 376
 377 static gboolean sslcertwindow_ask_expired_cert(SSLCertificate *cert)
 378 {
 379         gchar *buf, *sig_status;
 380         AlertValue val;
 381         GtkWidget *vbox;
 382         GtkWidget *label;
 383         GtkWidget *button;
 384         GtkWidget *cert_widget;
 385         gchar *invalid_str = sslcertwindow_get_invalid_str(cert);
 386         const gchar *title;
 387
 388         vbox = gtk_vbox_new(FALSE, 5);
 389         buf = g_strdup_printf(_("Certificate for %s is expired.\n%sDo you want to continue?"), cert->host, invalid_str);
 390         g_free(invalid_str);
 391
 392         label = gtk_label_new(buf);
 393         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 394         gtk_box_pack_start(GTK_BOX(vbox), label, TRUE, TRUE, 0);
 395         g_free(buf);
 396
 397         sig_status = ssl_certificate_check_signer(cert, cert->status);
 398
 399         if (sig_status==NULL)
 400                 sig_status = g_strdup(_("Correct"));
 401
 402         buf = g_strdup_printf(_("Signature status: %s"), sig_status);
 403         label = gtk_label_new(buf);
 404         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 405         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 406         gtk_box_pack_start(GTK_BOX(vbox), label, TRUE, TRUE, 0);
 407         g_free(buf);
 408         g_free(sig_status);
 409
 410         button = gtk_expander_new_with_mnemonic(_("_View certificate"));
 411         gtk_box_pack_start(GTK_BOX(vbox), button, FALSE, FALSE, 0);
 412         cert_widget = cert_presenter(cert);
 413         gtk_container_add(GTK_CONTAINER(button), cert_widget);
 414
 415         if (!ssl_certificate_check_subject_cn(cert))
 416                 title = _("SSL/TLS certificate is invalid and expired");
 417         else
 418                 title = _("SSL/TLS certificate is expired");
 419
 420         val = alertpanel_full(title, NULL,
 421                               _("_Cancel connection"), _("_Accept"), NULL,
 422                               ALERTFOCUS_FIRST, FALSE, vbox, ALERT_QUESTION);
 423
 424         return (val == G_ALERTALTERNATE);
 425 }
 426
 427 static gboolean sslcertwindow_ask_changed_cert(SSLCertificate *old_cert, SSLCertificate *new_cert)
 428 {
 429         GtkWidget *old_cert_widget = cert_presenter(old_cert);
 430         GtkWidget *new_cert_widget = cert_presenter(new_cert);
 431         GtkWidget *vbox;
 432         gchar *buf, *sig_status;
 433         GtkWidget *vbox2;
 434         GtkWidget *label;
 435         GtkWidget *button;
 436         AlertValue val;
 437         gchar *invalid_str = sslcertwindow_get_invalid_str(new_cert);
 438         const gchar *title;
 439
 440         vbox = gtk_vbox_new(FALSE, 5);
 441         label = gtk_label_new(_("New certificate:"));
 442         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 443         gtk_box_pack_end(GTK_BOX(vbox), new_cert_widget, TRUE, TRUE, 0);
 444         gtk_box_pack_end(GTK_BOX(vbox), label, TRUE, TRUE, 0);
 445         gtk_box_pack_end(GTK_BOX(vbox), gtk_hseparator_new(), TRUE, TRUE, 0);
 446         label = gtk_label_new(_("Known certificate:"));
 447         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 448         gtk_box_pack_end(GTK_BOX(vbox), old_cert_widget, TRUE, TRUE, 0);
 449         gtk_box_pack_end(GTK_BOX(vbox), label, TRUE, TRUE, 0);
 450         gtk_widget_show_all(vbox);
 451
 452         vbox2 = gtk_vbox_new(FALSE, 5);
 453         buf = g_strdup_printf(_("Certificate for %s has changed.\n%sDo you want to accept it?"), new_cert->host, invalid_str);
 454         g_free(invalid_str);
 455
 456         label = gtk_label_new(buf);
 457         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 458         gtk_box_pack_start(GTK_BOX(vbox2), label, TRUE, TRUE, 0);
 459         g_free(buf);
 460
 461         sig_status = ssl_certificate_check_signer(new_cert, new_cert->status);
 462
 463         if (sig_status==NULL)
 464                 sig_status = g_strdup(_("Correct"));
 465
 466         buf = g_strdup_printf(_("Signature status: %s"), sig_status);
 467         label = gtk_label_new(buf);
 468         gtk_label_set_selectable(GTK_LABEL(label), TRUE);
 469         gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
 470         gtk_box_pack_start(GTK_BOX(vbox2), label, TRUE, TRUE, 0);
 471         g_free(buf);
 472         g_free(sig_status);
 473
 474         button = gtk_expander_new_with_mnemonic(_("_View certificates"));
 475         gtk_box_pack_start(GTK_BOX(vbox2), button, FALSE, FALSE, 0);
 476         gtk_container_add(GTK_CONTAINER(button), vbox);
 477
 478         if (!ssl_certificate_check_subject_cn(new_cert))
 479                 title = _("SSL/TLS certificate changed and is invalid");
 480         else
 481                 title = _("SSL/TLS certificate changed");
 482         val = alertpanel_full(title, NULL,
 483                               _("_Cancel connection"), _("_Accept and save"), NULL,
 484                               ALERTFOCUS_FIRST, FALSE, vbox2, ALERT_WARNING);
 485
 486         return (val == G_ALERTALTERNATE);
 487 }
 488 #endif