[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Storing TLS credentials in the directory
Michael Ströder wrote:
Howard Chu wrote:
Turbo Fredriksson wrote:
Everything I’ve seen about the subject is so darn _complex_! It shouldn’t HAVE
to be.
Indeed, there's no reason for it.
Hmm, every time in a customer encryption/PKI project the customer requested that it
should be secure *and* easy to use. This is kind of a contradiction to begin with.
Bootstrapping is usually the hardest part. That's the part I've focused on
making easier.
Also this short discussion already oversimplifys all the possible use-cases and
considerations when talking about storing/using/protecting private keys. Personally I'd
never use such a autoca overlay running on the "normal" directory server.
(Over)simplification is exactly what is needed, most of the time.
So every technical design should start with a decent description of the use-cases or will
blatantly fail. This will lead to reviewing which name spaces have to be put in which
naming extension for which usage and who is authorized to use the keys and issue certs.
Simply starting with schema for private key storage is putting the cart before the horse.
You cannot write a decent design from scratch. It's important to have a
baseline of functionality to get an idea of scope. The current overlay
provides that baseline.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/