[openssl-users] Reload certificates?

[Scott Neugroschl]

I believe that's specific to the servers in question.  Often you can "restart" a server by giving it a SIGHUP.  I don't know if slapd and slurpd will respond in the way you want.


From: openssl-users [mailto:openssl-users-bounces at openssl.org] On Behalf Of Jordan Brown
Sent: Wednesday, May 18, 2016 10:44 AM
To: openssl-users at openssl.org
Subject: [openssl-users] Reload certificates?


We have OpenSSL consumers (primarily but not exclusively OpenLDAP).  Some of them are long-running processes.

We'd like to be able to update the list of trusted certificates and have the changes take effect, without needing to restart those long-running processes and preferably without needing to interact with them in any way.

It *looks* like the "file" style of certificate store is loaded once only, at the time it's specified, and never reloaded again for the life of a particular SSL context.  Similarly, it looks like in the "directory" style of certificate store once a particular certificate has been loaded, it's never unloaded, even if the underlying file is deleted.  It looks like the only way to see changes (and especially deletions) is to create a new SSL context.  In addition to the difficulty of getting middleware to do that, it seems like the middleware would need to either watch the files and directories on its own, or always create new SSL contexts for new connections, or something else similarly intrusive.

Is there something I'm missing?

Would it be reasonable to have OpenSSL watch the metadata on the file or directory and, on change, discard cached certificates and, for a file, reload the file?

--

Jordan Brown, Oracle Solaris


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20160518/a3a8caa1/attachment.html>