Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-06-01 Thread Daniel Kahn Gillmor
On 05/30/2012 07:34 PM, Ben Hutchings wrote: Since we don't seem to have a specific directory for server certificates, I suppose it should be under /etc/dovecot. If anyone following this bug report is coming to debconf12, i've submitted a BoF proposal to try to get together and hammer out some

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-06-01 Thread Jaldhar H. Vyas
On Fri, 1 Jun 2012, Daniel Kahn Gillmor wrote: On 05/30/2012 07:34 PM, Ben Hutchings wrote: Since we don't seem to have a specific directory for server certificates, I suppose it should be under /etc/dovecot. If anyone following this bug report is coming to debconf12, i've submitted a BoF

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-05-30 Thread Jaldhar H. Vyas
Sorry I couldn't participate in this conversation earlier but having read all the messages now, I am still wondering what exactly do I need to do in dovecot? I am working on the version that will go into the upcoming stable release so I would like to get this resolved to everyones

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-05-30 Thread Ben Hutchings
On Wed, 2012-05-30 at 18:20 -0400, Jaldhar H. Vyas wrote: Sorry I couldn't participate in this conversation earlier but having read all the messages now, I am still wondering what exactly do I need to do in dovecot? I am working on the version that will go into the upcoming stable release

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-04-09 Thread Daniel Kahn Gillmor
On 04/07/2012 12:46 PM, Kurt Roeckx wrote: At least the certdata.txt file contains the information, you can edit in iceweasel/firefox. edit at runtime or at compile time? system administrators ideally shouldn't have to recompile packages in order to add or drop system-wide default reliance on

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-04-09 Thread Kurt Roeckx
On Mon, Apr 09, 2012 at 09:52:44AM -0400, Daniel Kahn Gillmor wrote: On 04/07/2012 12:46 PM, Kurt Roeckx wrote: At least the certdata.txt file contains the information, you can edit in iceweasel/firefox. edit at runtime or at compile time? system administrators ideally shouldn't have

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-04-09 Thread Daniel Kahn Gillmor
On 04/09/2012 10:35 AM, Kurt Roeckx wrote: On Mon, Apr 09, 2012 at 09:52:44AM -0400, Daniel Kahn Gillmor wrote: On 04/07/2012 12:46 PM, Kurt Roeckx wrote: At least the certdata.txt file contains the information, you can edit in iceweasel/firefox. edit at runtime or at compile time? system

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-04-09 Thread Kurt Roeckx
On Mon, Apr 09, 2012 at 12:01:18PM -0400, Daniel Kahn Gillmor wrote: Can you propose a mechanism such that this info would not get lost? X509 has a way to embed the trust in the certificate itself, see TRUST SETTINGS in openssl's x509 manpage. This looks like it only works with PEM

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-04-07 Thread Kurt Roeckx
On Tue, Mar 20, 2012 at 01:22:29AM -0400, Daniel Kahn Gillmor wrote: Consider, for example, that libNSS allows the user to identify which root CAs are trusted to: * identify web sites, * identify e-mail users, or * sign code (some CAs may trusted for all three categories, some for

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-04-02 Thread Bill Allombert
On Tue, Mar 20, 2012 at 01:22:29AM -0400, Daniel Kahn Gillmor wrote: [this discussion started on http://bugs.debian.org/608719] On 03/19/2012 11:14 PM, Ben Hutchings wrote: On Sun, 2011-01-02 at 18:20 -0500, Daniel Kahn Gillmor wrote: It looks like dovecot-common's postinst script creates a

Bug#608719: Debian Policy about administrator X.509 certificate stores [was: Re: dovecot-common: please do not use /etc/ssl/certs for end-entity X.509 certificates (/etc/ssl/certs/dovecot.pem)]

2012-03-19 Thread Daniel Kahn Gillmor
[this discussion started on http://bugs.debian.org/608719] On 03/19/2012 11:14 PM, Ben Hutchings wrote: On Sun, 2011-01-02 at 18:20 -0500, Daniel Kahn Gillmor wrote: It looks like dovecot-common's postinst script creates a new X.509 certificate and places it in /etc/ssl/certs/dovecot.pem.