From Fedora Project Wiki


OpenLDAP defaults to use only Shared System Certificates

Summary

In order to go forward with adoption of SharedSystemCertificates after this change OpenLDAP clients and server will default to use only the system-wide certificates store.

Owner

Current status

Detailed Description

Currently, OpenLDAP defaults to trust CA certificates located in /etc/openldap/certs. In order to comply with SharedSystemCertificates we will remove the default explicit configuration options that point to /etc/openldap/certs. Therefore, OpenLDAP will let its crypto library (OpenSSL) load the default CA certificates as described in the SharedSystemCertificates description. For a convenience, where possible, configuration files will contain a commentary with an explanation of the new behaviour.

Benefit to Fedora

Simplification of trust handling which is also the aim of the SharedSystemCertificates effort.

Scope

  • Proposal owners: change of default shipped configuration.
  • Other developers: check your application trusts whom you want it to trust
  • Policies and guidelines: None.
  • Trademark approval: None. (not needed for this Change).

Upgrade/compatibility impact

There should be no upgrade impact at all as the only updated parts are configuration files which are not overwritten when upgraded, only .rpmnew files should appear accordingly. Therefore, only newly installed packages would ship with the changed default configuration.


How To Test

New installations should by default use what system-wide certificates store use. This means one should be able to make use of CA certificates as before but now they should be by default present in the system certificate store. When CA certificate would be migrated to the system certificate store and no explicit CA certificates location would be configured then TLS connections should behave as before.

User Experience

New installations will use the new default configuration, therefore users should alter their provisioning scripts to make use of system certificate store. Of course, explicitly setting the previous location will work as expected.

Dependencies

None.

Contingency Plan

  • Contingency mechanism: Revert configuration changes.
  • Contingency deadline: beta freeze.
  • Blocks release? No.
  • Blocks product? No.

Documentation

Follow the Features/SharedSystemCertificates with OpenSSL specifics. Related bugzilla [bug] discussing the change.

Release Notes

Default configuration does not point to /etc/openldap/certs for CA certificates any more. Instead, OpenLDAP now implicitly uses Shared System Certificates.