X-Git-Url: https://ruderich.org/simon/gitweb/?p=tlsproxy%2Ftlsproxy.git;a=blobdiff_plain;f=README;h=83b2442feaef4dbc2803127f947f38e6cbae3e65;hp=c88806b1f2f82724fc0aaaaf77d85ae5d5fc5613;hb=4b64428fe11db22f70c304de1bc9f0cc95f1d189;hpb=f3021c5aa0aad0710b3ae59c23a950f399c7ed96

diff --git a/README b/README
index c88806b..83b2442 100644
--- a/README
+++ b/README
@@ -11,6 +11,7 @@ tlsproxy is licensed under GPL 3 (or later).
 REQUIREMENTS
 ------------
 
+- C89 compiler
 - GnuTLS library including development headers
 - certtool (from GnuTLS) to create TLS certificates
 
@@ -23,7 +24,7 @@ This creates the following files:
 
 - `proxy-ca.pem`:      CA which is used for all connections to the client
 - `proxy-ca-key.pem`:  private key for the CA
-- `proxy-key.pem`:     private key for the server
+- `proxy-key.pem`:     private key for the proxy
 - `proxy-invalid.pem`: special certificate used for invalid pages
 
 Then import the CA file `proxy-ca.pem` in your browser so it can validate the
@@ -50,7 +51,7 @@ If an error occurs in the validation (missing `certificate-*.pem` files,
 fingerprint changed, etc.) it's logged by the proxy (stdout) and the special
 `proxy-invalid.pem` certificate is used to send a 500 error message to the
 client. The connection to the server is closed so there's no chance that any
-client data is sent to the (possible) evil server. The invalide certificate is
+client data is sent to the (possible) evil server. The invalid certificate is
 also easy to spot in the browser because it uses an invalid hostname
 ("invalid") and is self-signed.
 
@@ -67,7 +68,7 @@ this case the normal CA chain in your browser lets you validate the server
 certificate. If the server certificate changes you're _not_ informed!
 
 This option is useful if you often visit websites using HTTPS but you don't
-use critical information (e.g. no passwords, etc.) on this website.
+use critical information (e.g. no passwords, etc.) on these websites.
 
 For hostnames with a stored server certificate everything works as usual and a
 certificate change is detected.
@@ -79,11 +80,11 @@ certificate in `certificate-example.org.server.pem`. Without '-u' everything
 is fine.
 
 But if you use '-u' and an attacker redirects you to e.g.
-https://www.example.org/ (or https://whatever.org/) (for example through a
-link on a different site) then the proxy just forwards the TLS connection
-(because it doesn't know the fingerprint for https://www.example.org/, that's
-how '-u' works) and you won't be aware that a different server certificate
-might be used!
+https://www.example.org/ - leading .www - (or https://whatever.org/) (for
+example through a link on a different site) then the proxy just forwards the
+TLS connection (because it doesn't know the fingerprint for
+https://www.example.org/, that's how '-u' works) and you won't be aware that a
+different server certificate might be used!
 
 If you always verify the authentication of the connection this isn't a
 problem, but if you only check if it's a HTTPS connection then this attack is