Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-38326

Support PKCS12 certificate/key bundle files in libmariadb

    XMLWordPrintable

Details

    • New Feature
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • None
    • libmariadb
    • None

    Description

      currently libmariadb (and, consequently, all of the tools that use it, e.g. mariadb command line etc) can only take key material (certificates, keys, etc.) in PEM format via the --ssl-ca/-ssl-cert/ssl-key/.... parameters.

      But, most browsers and CA authorities provide PKCS12 files. Same is true for e.g. when one exports certificates from the MS Windows stores or MacOSX keychain app.
      In cases like this the openssl command line tool (pkcs12) needs to be used to extract the individual key materials from the pkcs12 bundle before they could be used by libmariadb based apps.

      It would be nice to allow taking in complete pkcs12 bundle file directly.

      One way to do this is to add a new --ssl-pkcs12-file command line option.
      An alternative would be to make --ssl-cert handling recognize the file format: e.g. scan for ASN.1 certificate markers and threat it as PEM encoded certs or, alternatively, try reading the file as pkcs12 binary data.

      I personally would suggest going with the new parameter since it's more specific.

      Note that, even if it might be technically possible to have multiple cert+key pairs (e.g. one coming from --ssl-pkcs12-file and the other coming from --ssl-cert/ssl-key), supporting this might be an over-kill and must be carefully considered during design phase.

      As an extension to this, MS Windows schannel libmariadb can be made to support accessing the windows certificate stores directly as well.

      Attachments

        1. d.diff
          8 kB
          Georgi Kodinov

        Activity

          People

            Unassigned Unassigned
            gkodinov Georgi Kodinov
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.