some initial cleanup for PEM
by Kai Engert
I commited a few changes:
https://git.fedorahosted.org/cgit/nss-pem.git/commit/?id=cf9834b1ccc3ed6a...
All changes have passed all the tests that I have. Local testing with
curl/pem/selfserv, and inhouse PEM regression tests.
If you want to give this more testing or review, I'll appreciate it.
- address some cleanup requests from rrelyea
- parts of the cleanup and comments are taken from emaldona's patches
- #if 0 some unused code (will remove later)
- actually use the loop variable i in pem_Initialize
- allocator consistency
- simplify/cleanup PUT_OBJECT/put_object code (fixes an incorrect
assumption,
allocation is based on number of items, not bytes)
- fix a crash with plog in debug mode
- in CreateObject with CKO_PRIVATE_KEY, don't reset
the nickname back to filename contents, seems wrong
Kai
9 years, 9 months
Re: [nss-pem] libcurl, libnss and PEM certificates
by Kamil Dudka
On Saturday, February 22, 2014 15:08:24 Alessandro Ghedini wrote:
> Hi all,
>
> I've been looking into ways to fix the no-PEM-certficates-with-libnss in
> Debian.
>
> The first solution that I tried was to use the libnsspem.so thingy from Red
> Hat [0], and it works I guess, but the problem is that it needs to be built
> as part of the libnss package, so it's a no-go for now.
>
> [0] https://git.fedorahosted.org/git/nss-pem.git
nss-pem is going to be included into the upstream distribution of nss.
Kai Engert is currently working on this.
> The other solution I tried was to use the p11-kit-trust.so module from the
> p11-kit project [0], which is already packaged for Debian. According to its
> documentation it should be a normal PKCS#11 module and a drop-in replacement
> for libnssckbi.so (whatever that means), so I simply replaced
> "libnsspem.so" with the path to it in libcurl sources to make libcurl use
> it.
>
> [0] http://p11-glue.freedesktop.org/
>
> The problem with the latter method is that, while libcurl loads the module
> correctly, it still doesn't work (that is, TLS connections fail because
> libcurl/libnss can't find a proper certificate):
>
> $ src/curl -v https://www.google.com
> [...]
> * Initializing NSS with certpath: none
> * Closing connection 0
> * The cache now contains 0 members
> * Expire cleared
> curl: (77) Problem with the SSL CA cert (path? access rights?)
>
> So, is there anyone who knows how to make it work (myself being quite
> ignorant regarding libnss)? Alternative solutions are welcome as well.
>
> The whole point of this would be to have the libcurl nss flavour in Debian
> being actually useful "by default" (which means being able to use the
> default Debian CA certificates that are in PEM format), due to the recent
> GnuTLS license problems [0]. Which means that I'm also interested in
> hearing opinions on OpenSSL vs GnuTLS vs NSS (is [1] up-to-date?) and also
> about having the nss flavour to be the default/only available version in
> Debian (I see that Red Hat has done the same thing, how did it go?).
>
> [0] https://lists.debian.org/debian-devel/2013/12/msg00329.html
> [1] http://curl.haxx.se/docs/ssl-compared.html
>
> Cheers
I am adding nss-pem-devel to CC. It is probably a more appropriate channel
for this discussion.
Kamil
10 years, 2 months