hashicorp / hashicorp/go-rootcerts

LoadCAPath does not work with standard OpenSSL format capath

Open
#16 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
84
Forks
18
PR merge metrics
No merged PRs in 30d

Description

LoadCAPath() currently attempts to load every file in the given directory as a PEM, or fails with a message "Error loading CA Path: Couldn't parse PEM in:" on the first file that is not a PEM certificate. The standard naming format for CA certificates in the directory is `.N` where N starts from 0 and goes up, and a corresponding `.rN` for CRLs from the same CA. There may also be other files in the same directory. I didn't find a good web reference documenting this, but someone complaining about it made an [openssl issue](https://github.com/openssl/openssl/issues/1701) describing the layout and the response was this was the way it it has always been.

I am especially troubled by the fact CRLs are not supported, because of the security implications.

Related issues: #8, #10

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.