[chef] RE: Re: Re: Re: Re: Chef * + bundled SSL cert bundles are not delightful

[Adam Edwards < >]

I would definitely be in favor of a feature to allow users to use the
Windows cert store. This would create some workflow differences between
Windows and non-Windows systems for instance, but overall it would make life
much simpler in multiple areas.

In theory, there's no reason we need to use OpenSSL on Windows -- we could
simply use the crypt32* APIs. This would give us Windows cert store
integration, among many other features.

-Adam

-----Original Message-----
From: Daniel DeLeo 
[mailto:
 
 On Behalf Of Daniel DeLeo
Sent: Friday, October 2, 2015 8:44 AM
To: 

 
Subject: [chef] Re: Re: Re: Re: Chef * + bundled SSL cert bundles are not
delightful



On Friday, October 2, 2015 at 3:00 AM, Tensibai wrote:

> Le 2015-10-02 11:35, Tomasz Torcz a écrit :
> > On Fri, Oct 02, 2015 at 10:57:15AM +0200, Tensibai wrote:
> > >
> > >
> > > Just a guess (unverified), but for bundler I had to use the
> > > environment variable SSL_CERT_FILE and point it to
> > > embedded/ssl/certs for it to work under windows. Maybe httpclient
> > > could take this env variable too ?
> >
> > It would be much better if Chef used one cert store, not a number of
> > them.
> > It would be perfect if Chef just used system CA store.
>
> If you're willing to make something to parse Windows system cert store
> to something like a .pem cert store on the fly, you're welcome to
> contribute it ;) (But it's really harder than it seems)
>

Someone actually contributed code for this to OpenSSL, but it was never
accepted, and I’m not sure why. Similarly, Apple never contributed their
patch for OpenSSL back upstream (AFAIK) and are moving on from OpenSSL in
general, so they are not maintaining their patch. Short of patching OpenSSL,
the only other way to do this is to extract the contents of the system store
to the cacert.pem file and format. But in order to get updates, this would
need to be able to run regularly.


--
Daniel DeLeo