Re: [Pki-devel] [PATCH] Lightweight CAs

Latest patches attached. Most issued addressed; see inline for comments and ticket URLs for deferred items. There is a problem with allowing authority DNs to be reused - when adding the cert to the NSSDB, despite what nickname you tell it to you, it will put the cert under the nickname of the existing cert with that subject DN. Thus when you go to find the cert by nickname, it cannot locate it. Failure ensues. This is possibly a bug in NSS (it's certainly surprising), but I need more time to analyse it. I've attached an experimental (builds, but as yet completely untested with high chance of brokens) patch on top of my current patches that switches to looking up the cert by issuer DN and serial. I need to consider implications of this switch including for renewal in replicated environments. It might not be the right approach but afaict it is the only other way CryptoManager gives you to look up a cert. Ideally we discover that NSS/JSS is doing the wrong thing with what it is doing with nicknames and we can get a fix there are move on with life. Anyhow, other comments inline. Thanks, Fraser On Thu, Sep 24, 2015 at 06:26:39PM -0500, Endi Sukma Dewata wrote: Thanks for this explanation. Worked a treat! Fixed the label, filed ticket for including the Parent/Issuer DN: https://fedorahosted.org/pki/ticket/1618 Done. Filed ticket: https://fedorahosted.org/pki/ticket/1617 Per discussion above, implemented, but breaks your CA if you try it! Done. Fixed; well spotted. Thanks a bunch; I will review this Monday. This also reminds me to spend some time updating the design pages as well - there have been many changes!