Re: Suggestion of change to certauth plugin interface

Nico Williams <[email protected]> Fri, 24 Feb 2023 13:34:47 -0600

Newsgroups	gmane.comp.encryption.kerberos.devel
Message-ID	<Y/[email protected]>

On Fri, Dec 09, 2022 at 07:16:14AM -0500, Ken Hornstein via krbdev wrote:
> >This wouldn't necessarily require a major API bump, but can you 
> >elaborate on what a certauth module would be interested in the 
> >configured realm list, and can't build it up as queries come in?
> 
> Sure.  I talked before that one of my plugins was for doing OCSP
> checking of client certificates for PKINIT.  Well, it turns out that
> to do that, you need to build up the complete certificate chain so you
> can check the status of intermediate certificates.  To do that, you
> [...]

Wait, why doesn't the KDC furnish the whole chain to the certauth
plugin?
_______________________________________________
krbdev mailing list             [email protected]
https://mailman.mit.edu/mailman/listinfo/krbdev