URL:
https://github.com/SSSD/sssd/pull/570
Title: #570: p11_child: add OpenSSL support
jhrozek commented:
"""
On 30 May 2018, at 11:03, sumit-bose <notifications(a)github.com>
wrote:
Hi Jakub,
the latest version fixes the softhsm2-util-p11tool issues, if one of the tools is missing
the test CA and related tests are not build.
Thanks, I’ll test this.
About additional files, yes there will be e.g. a file with the CRL (certificate
revocation list). So you would prefer a subdirectory?
I would, but it was just an idea, do you think the flat file is eaiser or better?
Would you like to suggest a name?
/etc/sssd/pki ?
The system CA store contains a lot of public CAs from all over the
world and recently there were cases where CAs had to be removed because there were
evidence the they issue certificates to people which were not owner of domains or emails
mentioned in the certificate. So there is a risk that someone can get a certificate from a
CA in the system CA store which would map to your account be rules based mapping. Hence I
prefer to have the CA certificates in a file on its own.
Additionally system CA stores might not be portable to different OS or distributions, so
it would be easier for documentation and bug hunting if SSSD has its own file.
OK, thank you for the explanation.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/570#issuecomment-393105818