Implement server acceptable certificate auths#332
Implement server acceptable certificate auths#332reynir wants to merge 1 commit intomirleft:masterfrom
Conversation
|
I should mention that I haven't tested this thoroughly. I have tested with The TODO in lib/handshake_server.ml mentions extracting "DN from authenticator", but since authenticator is a function it wouldn't be possible so I opted for adding Yet Another Configuration Option accepted_cas. It's not the best user experience since you have to repeat the CAs, once in the authenticator and once in the server config. Furthermore, the list of CAs will be static - there might be some use case for a dynamic list of CAs(?) |
|
thanks. indeed, I'd prefer to have the |
The code for accepted certificate authorities in a client certificate request was already implemented, but handshake_server.ml had hardcoded an empty list of CAs. This commit adds a configuration option for this.
|
Done. Have a nice nap+trip! :-) Edit: oops, this was supposed to go to mirleft/ocaml-x509#87 |
|
Did this ever get merged? |
|
@cfcs No, it's not been merged. |
|
thanks, superseeded by #374 (please let me know if you disagree with the changes in 374, I amended your commit, i.e. you're still the author :) |
|
Thanks! The logic seems to be the same modulo naming and DN-unwrapping, so no complaints from me. I look forward to play with client certificates again! |
The code for accepted certificate authorities in a client certificate
request was already implemented, but handshake_server.ml had hardcoded
an empty list of CAs. This commit adds a configuration option for this.
Note that this requires a change to ocaml-x509: mirleft/ocaml-x509#87