[chef] Re: Re: Re: Re: Chef * + bundled SSL cert bundles are not delightful

[Daniel DeLeo < >]

On Friday, October 2, 2015 at 3:00 AM, Tensibai wrote:

> Le 2015-10-02 11:35, Tomasz Torcz a écrit :
> > On Fri, Oct 02, 2015 at 10:57:15AM +0200, Tensibai wrote:  
> > >  
> > >  
> > > Just a guess (unverified), but for bundler I had to use the environment
> > > variable SSL_CERT_FILE and point it to embedded/ssl/certs for it to work
> > > under windows. Maybe httpclient could take this env variable too ?
> >  
> > It would be much better if Chef used one cert store, not a number of them.
> > It would be perfect if Chef just used system CA store.  
>  
> If you're willing to make something to parse Windows system cert store to 
> something like a .pem cert store on the fly, you're welcome to contribute 
> it ;) (But it's really harder than it seems)
>  

Someone actually contributed code for this to OpenSSL, but it was never 
accepted, and I’m not sure why. Similarly, Apple never contributed their 
patch for OpenSSL back upstream (AFAIK) and are moving on from OpenSSL in 
general, so they are not maintaining their patch. Short of patching OpenSSL, 
the only other way to do this is to extract the contents of the system store 
to the cacert.pem file and format. But in order to get updates, this would 
need to be able to run regularly.


--  
Daniel DeLeo