Signature MetadataFilter, name, CA, CRL comparison

[Cantor, Scott]

On 12/20/11 1:10 PM, "Marc Thornton" <marc.thornton at gmail.com> wrote:
>
>OpenSSL 0.9.8e, which is the default on RedHat Linux 5, doesn't even read
>the contents of the extension correctly. Based on some anecdotal
>information, it's possible that OpenSSL 1.x may actually read the details
>correctly but to determine whether it would handle it or match it with
>distribution point identified in the certificate would require additional
>investigation.  Change notes on the OpenSSL site for version 1.0.0 seem
>to identify that full support for this extension is in progress:

Needless to say, this is why I was reluctant to add even as much support
for them as I have. Once you start down that road, it's difficult to stop
and just say "no farther". I remain willing to apply reasonable and
non-extensive patches as long as others are willing to do the bulk of the
work and/or test them. It's just not a good use of my time beyond that.

-- Scott