GNOME Bugzilla – Bug 351858
x509 Key Support
Last modified: 2012-03-15 09:51:24 UTC
We need to support x509 certificates. There are many choices of libraries to use. It's more than likely that we'll need to support two or more at once: * GnuTLS * NSS * OpenSSL We'd list the CA certificates under 'Keys I Trust', and personal certificates under 'Personal Keys'. Once we have all these key types we need options to allow people to turn off display of key types they're not interested in.
I've done some work with NSS which is an important library for us to support. Evolution uses NSS for it's S/MIME support. Commited some work to the seahorse-x509 branch. However after a good deal of work I've hit a brick wall. NSS does not support concurrent access to it's key store. So that puts an end to that idea for now. It seems that NSS 3.13 will support concurrent access. However that's not due for at least another year or so: http://wiki.mozilla.org/NSS:Roadmap
Hmmm, NSS has different methods of initializing it. In particular: NSS_Init NSS_InitReadWrite I wonder if the key manager (seahorse) could use the latter and the key consumers (evolution) could use the former and thus have concurrent access to the NSS db files. I'll ask on mozilla.dev.tech.crypto.
Maybe https://bugzilla.mozilla.org/show_bug.cgi?id=178806#c64 and #c68, #c69 are helpful too.
That plan (in comment #2) won't work: http://groups.google.com/group/mozilla.dev.tech.crypto/browse_thread/thread/baac989e722e9538/41a0415237486f6a
Hopefully, once GnomeKeyring becomes a PKCS#11 provider, we can use that to manage the user's X509 certificates: http://live.gnome.org/GnomeKeyring/Cryptoki
Stef, Is this now complete?
Yes and now. There's some support complete. This is an ongoing project to try and complete. gnome-keyring now has a PKCS#11 provider. I'm spending some time this cycle modularizing this for better testing and solid functionality. I'll be posting something about this to the gnome-keyring list shortly. I've also done some work more work on the PKCS#11 support in seahorse. I hope to do more work on it this release. These are my two top main focuses. All the other refactoring of seahorse was to this end. To try and get seahorse to the point where we can add functionality like this smoothly and easily. As far as this bug... It represents a vast amount of ongoing work. It may not make sense as a single bug.
I don't consider this a GNOME 2.28 target blocker. Setting the module specific target milestone instead.
Seahorse in 3.4 now has the ability to view, delete, and import X509 certificates and keys.