I've been threatening to discuss this for some time. I've been aware of the problem for some time but more recently it has started to seriously hamper related development. Anyway here goes... Currently there is IMHO a big problem in the way OpenSSL handles private keys, certificates and CRLs. At best all you've got is a bunch of files with the actual 'structure' contained inside. This is fine at a basic level but for many more advanced applications it is no good at all. A typical example is a smart card: things can be done transparently once the actual key has been set up, however to set up the key needs a local non portable hack. What would be better would be to allow code that supported the card to "install" its a key and certificates so any application could say use key "foo" on driver "bar" and not worry about where it comes from. This would mean for example that an SSL application could automatically use plain files, smart cards, crypto accelerators, PKCS #12 files, PKCS#11 libraries or custom databases and not worry about the details. Similarly there is a problem with certificate stores containing trusted CAs. Currently there are two main options, the directory full of symbolic links or "everything in a file". The symbolic link option doesn't even work on environments without sym links (e.g. Win32) and even then it can only lookup certificates based on subject name (and then only one match). Ideally you should be able to include a "trust database" which contains certificates that can be looked up in a variety of ways and each certificate can be trusted or distrusted for separate purposes: SSL client, SSL server etc etc. OK that's the problem as I see it. Comments welcomed. I'll give more info shortly. If you think "X509_LOOKUP will do all that" then read the second message. Steve. -- Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/ Personal Email: [EMAIL PROTECTED] Senior crypto engineer, Celo Communications: http://www.celocom.com/ Core developer of the OpenSSL project: http://www.openssl.org/ Business Email: [EMAIL PROTECTED] PGP key: via homepage. ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
