In order to go forward with adoption of SharedSystemCertificates after this change OpenLDAP clients and server will default to use only the system-wide certificates store.
Currently, OpenLDAP defaults to trust CA certificates located in
/etc/openldap/certs. In order to comply with SharedSystemCertificates we will remove the default explicit configuration options that point to
/etc/openldap/certs. Therefore, OpenLDAP will let its crypto library (OpenSSL) load the default CA certificates as described in the SharedSystemCertificates description. For a convenience, where possible, configuration files will contain a commentary with an explanation of the new behaviour.
Benefit to Fedora
Simplification of trust handling which is also the aim of the SharedSystemCertificates effort.
- Proposal owners: change of default shipped configuration.
- Other developers: check your application trusts whom you want it to trust
- Policies and guidelines: None.
- Trademark approval: None. (not needed for this Change).
There should be no upgrade impact at all as the only updated parts are configuration files which are not overwritten when upgraded, only .rpmnew files should appear accordingly. Therefore, only newly installed packages would ship with the changed default configuration.
How To Test
New installations should by default use what system-wide certificates store use. This means one should be able to make use of CA certificates as before but now they should be by default present in the system certificate store. When CA certificate would be migrated to the system certificate store and no explicit CA certificates location would be configured then TLS connections should behave as before.
New installations will use the new default configuration, therefore users should alter their provisioning scripts to make use of system certificate store. Of course, explicitly setting the previous location will work as expected.
- Contingency mechanism: Revert configuration changes.
- Contingency deadline: beta freeze.
- Blocks release? No.
- Blocks product? No.
Default configuration does not point to /etc/openldap/certs for CA certificates any more. Instead, OpenLDAP now implicitly uses Shared System Certificates.