ACK On Wed, 2013-04-10 at 21:05 -0700, Christina Fu wrote:

On 04/11/2013 09:11 AM, Ade Lee wrote: The Issuer DN of a cert and the Subject DN of the issuer's cert have to be encoded exactly the same, therefore, the string comparison within the same Java VM should result the same. Ideally, I'd want to compare Authority Key Identifier and Subject Key Identifier but due to the lack of JSS exposure for appropriate NSS functions, I took an easier route. This brought up something else. I originally was going to look through PKCS7 instead of searching the DB for efficiency, however, again, due to lack of JSS functions, I had to change course yesterday. I made such decision because pkisilent is just a tool that is to be run once during installation, so if it does take a little longer it should be fine for now. I think later when we have time we should refactor JSS and offer richer interfaces. thanks, Christina