On 9 Apr 2017, at 04:06, Howard Chu hyc@symas.com wrote:

It's clear that nobody in the standards organizations considers storing private keys in the directory to be a safe thing to do. IMO this is just a matter of password security and good ACLs, and the standards should not preclude the option. It is no worse than storing userPassword.

I agree (fwiw).

It needs to be stored SOMEWHERE. Usually it’s in/on the filesystem. And the only two (?) things that protect it there is:

1) The access permissions on the file. I.e., “ACLs". 2) No/limited users allowed on the system. I.e., "password security" (?)

So using “ACLs" and "password security" on the filesystem or in the directory, shouldn’t be that different.

Only difference might be that the local FS isn’t available _outside_ the host, a directory is.