On 9 Apr 2017, at 04:06, Howard Chu <hyc(a)symas.com> wrote:
It's clear that nobody in the standards organizations considers
storing private keys in the directory to be a safe thing to do. IMO this is just a matter
of password security and good ACLs, and the standards should not preclude the option. It
is no worse than storing userPassword.
I agree (fwiw).
It needs to be stored SOMEWHERE. Usually it’s in/on the filesystem. And the only two (?)
things that protect it there is:
1) The access permissions on the file. I.e., “ACLs".
2) No/limited users allowed on the system. I.e., "password security" (?)
So using “ACLs" and "password security" on the filesystem or in the
directory, shouldn’t be
Only difference might be that the local FS isn’t available _outside_ the host, a