[19536] in Kerberos_V5_Development
Re: NSS PKINIT requires nsCertType extension?
daemon@ATHENA.MIT.EDU (Greg Hudson)
Wed Feb 1 11:48:56 2017
To: Matt Rogers <mrogers@redhat.com>
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <5435ef29-895a-70d5-8fa3-68b837eab5b0@mit.edu>
Date: Wed, 1 Feb 2017 11:48:48 -0500
MIME-Version: 1.0
In-Reply-To: <CAAeFVfy3w7P=s6DvKapdQY2xJeyjAc=Hk6B8nLax+oykT2LW1Q@mail.gmail.com>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 02/01/2017 11:44 AM, Matt Rogers wrote:
>> I remember NSS having some behavior differences which made NSS PKINIT
>> not a drop-in for the OpenSSL implementation, but I don't remember if
>> this was one Nalin had discussed. I went back and looked at the
>> conversation on krbdev in September and October 2011 when we merged it,
>> but there wasn't any discussion of behavior differences there.
I found the discussion I was thinking of. It was in private mail so I
won't quote it, but the summary is that NSS doesn't seem to allow the
use of server certificates that aren't SSL certs (which I think matches
the problem you encountered). To me, that's a pretty fatal flaw in NSS
as a general-purpose X.509 library and in the NSS PKINIT support.
> If it was only used by the crypto consolidation effort then perhaps we
> can remove it (I will ask around). The cert authorization plugin
> framework needed new functions in the PKINIT crypto backend, which I
> wrote for the OpenSSL variant, so I was giving it a shot before I went
> about writing NSS versions. But I can hold off on those for now if the
> NSS support is in limbo.
Sounds good.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
