Full_Name: Jan Vcelak Version: git master OS: Linux URL: http://jvcelak.fedorapeople.org/openldap-patches/jvcelak-120622-0002-MozNSS-... Submission from: (NULL) (209.132.186.34)

PEM certificates should not be referenced by nicknames, because the nicknames are derived from basename of the cerificate file and in general are not easy-predictable.

The code of Mozilla NSS backend depends on some aspects of PEM module and tries to guess the nicknames correctly. In some cases the guessing is wrong.

This patch changes this approach and the PEM certificates are no longer referenced by nicknames. DER value of the certificate is extracted when the PEM file is loaded into the database and this DER value is then used to retrieve the certificate object. When certificate database is used (not PEM), certificates are retrieved using nickname as before.

The retrieved certificate objects (and associated private keys) are now stored directly in the tlsm_ctx structure and the nickname (certname) disappears.

The changes are quite broad, but the code was simplified on many places.

This approach was recommended by Mozilla NSS developers and was recently implemented for example in CURL.

Patch could not upload to OpenLDAP FTP server due to "No space left on device. Therefore I have uploaded the patch to fedorapeople.org. The patch is also available in 'moznss' branch of git://github.com/fcelda/openldap.git repository.

The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms.

Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.