Default for OpenSSL for crypto #4521

sssd-bot · 2020-05-02T13:42:21Z

Cloned from Pagure issue: https://pagure.io/SSSD/sssd/issue/3495

Created at 2017-08-30 15:34:06 by jhrozek
Closed at 2018-06-05 21:28:11 as Fixed
Assigned to nobody

Currently we default to NSS for crypto operations. We should switch to OpenSSL as it's more widely used, easier to develop for. Also, many distributions, like fedora, are moving away from NSS in an attempt to only have a single crypto library in the default installation.

Comments

Comment from jhrozek at 2017-08-31 21:38:05

Metadata Update from @jhrozek:

Issue set to the milestone: SSSD 2.0

Comment from jhrozek at 2017-12-07 20:33:31

Metadata Update from @jhrozek:

Issue priority set to: blocker

Comment from ktdreyer at 2018-01-29 20:52:48

Could you share more information about this plan to move away from NSS?

Comment from jhrozek at 2018-01-29 21:01:37

I'm not sure what exactly is it you're asking, but Fedora as a whole is moving away from NSS. curl dropped NSS, openldap dropped NSS, so SSSD might be one of the last packages requiring OpenSSL in the distribution.

It's unclear when exactly this will happen, probably in the F-29 cycle rather than F-28.

Comment from fidencio at 2018-06-05 21:17:21

Commit 8adf6ead relates to this ticket

Comment from fidencio at 2018-06-05 21:17:22

Commit ee76c686 relates to this ticket

Comment from fidencio at 2018-06-05 21:27:48

Fixed as part of the following series ...
master:
2f897af
176e4d2
842daeb
4f63a1a
7190e0e
165f58a
b5136cd
6d6e4a5
4eed225
075f2f3
ee76c68
8adf6ea
8127b58