rustls / rustls/rustls-platform-verifier
Add PKCS#11 / p11-kit verifier for Linux
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 158
- Forks
- 60
- Avg merge
- 5d 10h
- Merged PRs (30d)
- 3
Description
As mentioned in several places, the current problems with Linux are that the certificates are loaded only once and there are no trust decisions available.
Several distributions use p11-kit as a way to list certificates on the system and to list other PKCS#11 modules, and expose them via its API or a PKCS#11 proxy module. By interacting with it, we get an up-to-date list of certificates, and each certificate has a trust decision.
There is support for this in other TLS libraries:
- GnuTLS links p11-kit directly
- There is a PKCS#11 provider for OpenSSL, that uses p11-kit's proxy module by default.
- p11-kit can replace NSS's PKCS#11 module with its own.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the existing Linux certificate-loading and verification entry points, then read the p11-kit trust-module API and PKCS#11 proxy-module documentation linked in the issue. Done should provide an up-to-date certificate list and use each certificate's p11-kit trust decision during verification, with the integration and platform behavior defined before implementation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100