libverto event context for certauth plugin?
Ken Hornstein <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.devel |
|---|---|
| Message-ID | <[email protected]> |
So, as mentioned previously here, I am working on some certauth plugins to do (among other things) OCSP revocation checking. Right now in our deployment we have an OCSP server ON our KDCs and download the CRLs to it nightly, so I'm not worried about network delays blocking the KDC (unless I screw up the OCSP server, which is always possible). But it DOES occur to me that it might make sense to support things like checking the OCSP server that is actually listed in a certificate, but that would make it possible for the KDC to block. The obvious answer is to deal with this to pass down the libverto context to the certauth plugin and then make certauth asynchronous. But ... I completely recognize that is NOT a small amount of code, makes the pkinit plugin more complicated, and requires a change to the certauth plugin API. I do not know if this is a corner case or not; I just wanted to raise it as something I could see being useful, but it may be that not many people need this functionality. So ... thoughts? --Ken _______________________________________________ krbdev mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/krbdev