Re: X.509 and CA certificates for other purposes (i.e. the IGTF)
On Fri, May 24, 2013 at 12:32:29PM +0200, Dennis van Dok wrote:
> The point I'd like to raise is that the current model of CA
> certificates seems to take an all-or-nothing approach: either a CA is
> trusted (for whatever purpose) or not. For the IGTF CAs, this may not
> be the right approach.
One of the things I would like to see is that trust settings are
part of a systemwide store. This means that you can say you trust
a CA for clients, servers, email, codesigning, ...
Certificated in ca-certificates mostly come from mozilla, and they
already have such trust settings. However they're lost when
imported in ca-certificates, so applications ussing the
certificates from ca-certificates can't check that.
Openssl can add such trust settings (see x509(1ssl), section
TRUST SETTINGS). However it changes the format of the PEM
file, and gcrypt can't read this.
Kurt
Reply to: