- United States
- https://bancino.net
- Joined on
2024-09-14
Ah, that's a bummer. I suppose maybe it would suffice to have CYTO_TLS_CA
replace the system's CA store for all implementations. In other words, have Libre and Open check CYTO_TLS_CA
and load…
Okay, I think I'm good with what you've done here. I do have a question though: Can you load multiple PEMs? Like, why bother with return true
on success, when you could just keep going and…
(and that I really wouldn't use something like the Rand API for cryptographic tasks)
I agree, and that's the real problem here. Ideally, we should use the Rand API to generate the MbedTLS…
We should definitely try to use the system's CA store when possible. I don't know if there's a standard location for this, but on all the systems I've used, it's been /etc/ssl/cert.pem
.
Then…
Again, why should this come from the environment? Is there a way we can somehow just use the system's CA file?
Forgive me for not understanding MbedTLS that well, but why does this need to be sourced from the environment? Can't we randomly generate a seed? What's the use case for using the same seed more than once?