Details
-
New Feature
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
None
-
None
Description
currently libmariadb (and, consequently, all of the tools that use it, e.g. mariadb command line etc) can only take key material (certificates, keys, etc.) in PEM format via the --ssl-ca/-ssl-cert/ssl-key/.... parameters.
But, most browsers and CA authorities provide PKCS12 files. Same is true for e.g. when one exports certificates from the MS Windows stores or MacOSX keychain app.
In cases like this the openssl command line tool (pkcs12) needs to be used to extract the individual key materials from the pkcs12 bundle before they could be used by libmariadb based apps.
It would be nice to allow taking in complete pkcs12 bundle file directly.
One way to do this is to add a new --ssl-pkcs12-file command line option.
An alternative would be to make --ssl-cert handling recognize the file format: e.g. scan for ASN.1 certificate markers and threat it as PEM encoded certs or, alternatively, try reading the file as pkcs12 binary data.
I personally would suggest going with the new parameter since it's more specific.
Note that, even if it might be technically possible to have multiple cert+key pairs (e.g. one coming from --ssl-pkcs12-file and the other coming from --ssl-cert/ssl-key), supporting this might be an over-kill and must be carefully considered during design phase.
As an extension to this, MS Windows schannel libmariadb can be made to support accessing the windows certificate stores directly as well.