Michael Ströder wrote:

Howard Chu wrote:

...

Turbo Fredriksson wrote:

...

Everything I’ve seen about the subject is so darn _complex_! It shouldn’t HAVE to be.

Indeed, there's no reason for it.

Hmm, every time in a customer encryption/PKI project the customer requested that it should be secure *and* easy to use. This is kind of a contradiction to begin with.

Bootstrapping is usually the hardest part. That's the part I've focused on making easier.

Also this short discussion already oversimplifys all the possible use-cases and considerations when talking about storing/using/protecting private keys. Personally I'd never use such a autoca overlay running on the "normal" directory server.

(Over)simplification is exactly what is needed, most of the time.

So every technical design should start with a decent description of the use-cases or will blatantly fail. This will lead to reviewing which name spaces have to be put in which naming extension for which usage and who is authorized to use the keys and issue certs. Simply starting with schema for private key storage is putting the cart before the horse.

You cannot write a decent design from scratch. It's important to have a baseline of functionality to get an idea of scope. The current overlay provides that baseline.