Re: cert file location (was Re: sslio documentation clarification (Re: ipsvd-0.9.0 available))

On Tue, 4 May 2004, Gerrit Pape wrote:

> > This strikes me as wrong. What value is there in having the keys inside 
> > the jail (and readable by the application)? Wouldn't this be better?
> 
> Maybe.  Let me ask the other way round: What value is there in having
> the keys outside the jail?  The contents of the files are in memory of
> the sslio program anyway.

True. It's probably a little easier to steal the content of readable files 
than from somewhere in process memory. There's not going to be a fork/exec 
inside the jail, so the cert information will always be there.

[BTW I'm puzzled by the -K key args - doesn't the pem cert file contain 
all that's needed?]

> The idea was to run as few code from the ssl library as possible as
> root.  Currently it's only matrixSslOpen().

Understood. But is the matrixSSL library really likely to be under attack 
via the content of the certificate/key files?

Charlie