Title: #321: certmap: add OpenSSL implementation
Thank you for the review, I addressed all your comments.
About the tickets, the validation is currently done in two places, the ssh responder and
p11_child. So I think https://pagure.io/SSSD/sssd/issue/2880
is justified, even if the
solution will be to call p11_child from the ssh responder to validate the certificate
which is the solution I currently prefer.
See the full comment at https://github.com/SSSD/sssd/pull/321#issuecomment-325358022