certs.pem (certs120102.zip)

[JJoe]

ReadMe.txt Wrote:NEW: Proxomitron now can check to make sure the certificate on the
remote server is valid. It looks for a file named "certs.pem" in
the Proxomitron base folder. If found, this file should contain
a list of trusted certificate authorities in the PEM format used
by OpenSSL.

"If found", so after you removed "certs.pem" the Proxomitron simply decrypted the data. No attempt was made to validate the certificate.

ReadMe.txt Wrote:Proxomitron will pop-up it's own certificate warning dialog if
the SSL site's certificate has problems or can't be matched to
one of the trusted certificates on file.

So far, I've removed two certificates that generated errors (and am seeing errors related to other "new" certificates). I'm assuming that the remaining certificates get the job done correctly.
A guess is that some of the new certificates indicate abilities that the Proxomitron does not have.

Current "new" errors are of the "Certificate's host name (CN) doesn't match the site's" or the CN contains a wildcard variety, http://www.torproject.org or http://www.hsn.com .

I would rather people use a "certs.pem" and

ReadMe.txt Wrote:Keep in mind certificates are just used to help insure your actually
connecting to the site you think you are and not some "spoofed" site.
Whether they actually do this or not is debatable. Many sites (especially
smaller ones) may not be using properly "signed" certificates, but this
doesn't mean your connection is not as encrypted. Really all it means is
they didn't cough up some money for VeriSign's official stamp of approval.
Likewise, a valid certificate is no guarantee a site won't rip you off -
you must still be careful before trusting a site with sensitive data.

Still, that being said, it's always safer to connect in pass-thru mode
(see below) in cases where security is critical

HTH