On Tue, 4 Sep 2012, [email protected] wrote:
While adapting 'mk-ca-bundle' to generate separate PEM files for 'sendmail'
I came across a bug in the state-machine logic that reads 'certdata.txt'.
Thanks for your contribution! But...
You seem to have based your version on a rather old version of the
mk-ca-bundle script. Look at the most recent one here and see if you can spot
a problem with it:
https://github.com/bagder/curl/blob/master/lib/mk-ca-bundle.pl
I've attached my revised script, which breaks PEM files out separately.
'openssl' presents all 156 CA cert subjects in the TLS negotiation when a
'ca-bundle.pem' approach is taken. This adds 25k to the TLS
handshake--expensive. With separate files hash-linked by 'c_rehash', only
the one or two parent certificates included in cacert.pem are presented
during TLS startup. Openssl version 1.0.1 was used.
The c_rehash approach is however very OpenSSL-specific and it isn't supported
by other libs. That's the primary reason I think the script's default action
should be to generate the single PEM output.
Of course we could have it feature an option to do the many-files approach.
It should be fairly easy to back the loop-logic changes or something similar
into the original.
I disagree, and if you diff against the most recent version you'll see what I
mean...
--
/ daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
