URL:
https://github.com/SSSD/sssd/pull/570
Title: #570: p11_child: add OpenSSL support
sumit-bose commented:
"""
Hi Jakub,
the latest version fixes the softhsm2-util-p11tool issues, if one of the tools is missing
the test CA and related tests are not build.
About additional files, yes there will be e.g. a file with the CRL (certificate revocation
list). So you would prefer a subdirectory? Would you like to suggest a name?
The system CA store contains a lot of public CAs from all over the world and recently
there were cases where CAs had to be removed because there were evidence the they issue
certificates to people which were not owner of domains or emails mentioned in the
certificate. So there is a risk that someone can get a certificate from a CA in the system
CA store which would map to your account be rules based mapping. Hence I prefer to have
the CA certificates in a file on its own.
Additionally system CA stores might not be portable to different OS or distributions, so
it would be easier for documentation and bug hunting if SSSD has its own file.
bye,
Sumit
"""
See the full comment at
https://github.com/SSSD/sssd/pull/570#issuecomment-393086519