Re: root certificate

[Mark H Weaver <mhw@netris.org>]

Hi Chris,

Chris Marusich <cmmarusich@gmail.com> writes:

> Mark H Weaver <mhw@netris.org> writes:
>
>>            ;; Create hash symlinks suitable for OpenSSL ('SSL_CERT_DIR' and
>>            ;; similar.)
>>            (chdir (string-append %output "/etc/ssl/certs"))
>>            (invoke (string-append perl "/bin/perl")
>>                    (string-append openssl "/bin/c_rehash")
>>                    ".")))))
>
> I didn't know about c_rehash until now.  Interesting!  In the past, I've
> defined my own certificate packages as described in my own separate
> replies to this thread, and they worked even though I didn't invoke
> c_rehash.  Could this simply have been because the software I use
> happens to work even when the symlinks created by c_rehash don't exist?

According to the c_rehash man page, "many programs that use OpenSSL
require directories to be set up like this in order to find
certificates."  I'm not sure, but I guess that programs based on GnuTLS
do not need the symlinks.

> It looks like the ca-certificate-bundle profile hook (defined in
> guix/profiles.scm) doesn't currently invoke c_rehash.  Should it?

If I understand correctly, as long as each certificate package runs
'c_rehash' individually, then running 'c_rehash' during the profile hook
should have no effect, because all of the certificates will already have
their associated hash symlinks installed.

     Regards,
       Mark