URL:
https://github.com/SSSD/sssd/pull/570
Title: #570: p11_child: add OpenSSL support
jhrozek commented:
"""
On 30 May 2018, at 12:39, sumit-bose <notifications(a)github.com>
wrote:
About /etc/sssd/pki, I'm sorry, I didn't understood you correctly in the first
place. You suggested to use a directory based CA store (e.g. TLS_CACERTDIR of OpenLDAP)
instead of a file based one (e.g. TLS_CACERT of OpenLDAP). If prefer the file bases one
because of do not have run some rehash command to create the needed link in the directory
store and you can easy link it to other files based stores like e.g. the IPA one.
Nevertheless we can you /etc/sssd/pki to that the file name will be
/etc/sssd/pki/sssd_auth_ca_db.pem. The upcoming file with the CRL will then be
/etc/sssd/pki/sssd_auth_crl.pem. And if there is really a need for a directory store we
can add e.g. /etc/sssd/pki/ca_certs/.
I tried to suggest TLS_CACERT from the start, I just don’t like putting files in the
/etc/sssd directory because if we ever want to have e.g. some different access control to
a subset of the files, it’s easier to do if the files are in a directory. And if there are
multiple related files (like the CRL you mentioned) it’s cleaner to have them in the same
directory.
Do you agree?
Yes, I do.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/570#issuecomment-393193240