[19534] in Kerberos_V5_Development
Re: NSS PKINIT requires nsCertType extension?
daemon@ATHENA.MIT.EDU (Greg Hudson)
Wed Feb 1 11:07:22 2017
To: Matt Rogers <mrogers@redhat.com>, krbdev@mit.edu
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <9ab9b404-3429-5ba6-4dd0-6d1fe04cf7d2@mit.edu>
Date: Wed, 1 Feb 2017 11:07:06 -0500
MIME-Version: 1.0
In-Reply-To: <CAAeFVfxrTwp6rKW3c2=HZH6ga+0=fnzmYAjQ0Gvp-j9YgCU97g@mail.gmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 01/31/2017 10:09 AM, Matt Rogers wrote:
> It turns out NSS is expecting the Netscape
> certificate type extension (nsCertType = client/server in
> openssl.cnf), and adding it to the test certificates made the tests
> pass. Is this expected, or documented anywhere?
I remember NSS having some behavior differences which made NSS PKINIT
not a drop-in for the OpenSSL implementation, but I don't remember if
this was one Nalin had discussed. I went back and looked at the
conversation on krbdev in September and October 2011 when we merged it,
but there wasn't any discussion of behavior differences there.
I've actually been meaning to ask if we can remove the NSS PKINIT
implementation, since it was motivated by
https://fedoraproject.org/wiki/FedoraCryptoConsolidation
which is now defunct. What led you to try it out?
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
