<html>
<head>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>We have OpenSSL consumers (primarily but not exclusively
OpenLDAP). Some of them are long-running processes.<br>
</p>
<p>We'd like to be able to update the list of trusted certificates
and have the changes take effect, without needing to restart those
long-running processes and preferably without needing to interact
with them in any way.</p>
<p>It *looks* like the "file" style of certificate store is loaded
once only, at the time it's specified, and never reloaded again
for the life of a particular SSL context. Similarly, it looks
like in the "directory" style of certificate store once a
particular certificate has been loaded, it's never unloaded, even
if the underlying file is deleted. It looks like the only way to
see changes (and especially deletions) is to create a new SSL
context. In addition to the difficulty of getting middleware to
do that, it seems like the middleware would need to either watch
the files and directories on its own, or always create new SSL
contexts for new connections, or something else similarly
intrusive.<br>
</p>
<p>Is there something I'm missing?</p>
<p>Would it be reasonable to have OpenSSL watch the metadata on the
file or directory and, on change, discard cached certificates and,
for a file, reload the file?</p>
<p>-- <br>
</p>
<p>Jordan Brown, Oracle Solaris</p>
<p><br>
</p>
</body>
</html>