Re: cert file location (was Re: sslio documentation clarification (Re: ipsvd-0.9.0 available))

* Charlie Brady <[email protected]>:
> True. It's probably a little easier to steal the content of readable files 
> than from somewhere in process memory. There's not going to be a fork/exec 
> inside the jail, so the cert information will always be there.

Compromised is compromised. It doesnt really matter if the
attacker really got the keyfiles, you have to assume that he has
succeeded (and get new certs, and add the old ones to the crl).

> [BTW I'm puzzled by the -K key args - doesn't the pem cert file contain 
> all that's needed?]

Depends. You can split the information into two files (PEM files
just contain two Base64 encoded Blocks, preceded by an ASCII
string.

> Understood. But is the matrixSSL library really likely to be under attack 
> via the content of the certificate/key files?

I would vote for certificates outside of the chroot, just for the
sake of lazyness.