1. Forum
  2. Usenet
  3. LINUX.DEBIAN.BUGS.DIST

  • Bug#1107629: OpenSSL: Using case specific root CA trust stores

    From Peter Wienemann@21:1/5 to All on Wed Jul 23 12:00:02 2025
    Dear OpenSSL maintainers,

    I would like to tap on your expertise trying to address #1107629, in
    particular item 2 mentioned in [0]. Is there an easy way to make openssl
    aware of two separate root CA trust stores and teach it to use the
    suitable one for each use case?

    Other suggestions to fix #1107629 are welcome, too - in particular if
    they are more straightforward. :-)

    Best regards

    Peter

    [0] https://bugs.debian.org/1107629#10

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Kurt Roeckx@21:1/5 to All on Wed Jul 23 21:00:04 2025
    ------T2ZYOD5TB1MBLBD83A4FHEWTKCDRY6
    Content-Type: text/plain;
    charset=utf-8
    Content-Transfer-Encoding: quoted-printable

    The other option is that we ship a trust store with trust settings. Someone is making it more useful upstream at https://github.com/openssl/openssl/pull/27965

    That would be an OpenSSL only solution. We could ship them in a separate directory, and have OpenSSL default to that.

    Shipping it in a separate directory per type would require that all software using smime sets the path correctly. Shipping the trust settings with the certificate requires the software to say for what purpose they are using it, which most probably don't.

    Maybe we should try to do both.

    Kurt


    ------T2ZYOD5TB1MBLBD83A4FHEWTKCDRY6
    Content-Type: text/html;
    charset=utf-8
    Content-Transfer-Encoding: quoted-printable

    <!DOCTYPE html><html><body><div dir="auto">The other option is that we ship a trust store with trust settings. Someone is making it more useful upstream at <a href="https://github.com/openssl/openssl/pull/27965">https://github.com/openssl/openssl/pull/
    27965</a><br><br>That would be an OpenSSL only solution. We could ship them in a separate directory, and have OpenSSL default to that. <br><br>Shipping it in a separate directory per type would require that all software using smime sets the path
    correctly. Shipping the trust settings with the certificate requires the software to say for what purpose they are using it, which most probably don't. <br><br>Maybe we should try to do both. <br><br>Kurt<br><br></div></body></html>
    ------T2ZYOD5TB1MBLBD83A4FHEWTKCDRY6--

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)