Hi!
>>>>> "Davi" == Davi Arnaut <Davi.Arnaut@stripped> writes:
Davi> On 11/7/09 2:14 PM, Phillip Moore wrote:
<cut>
>> I recently implemented SSL for an application I own, and automated
>> everything from start to finish. I can recreate the entire set of
>> certificates (from the root up) with a couple of commands. I can
>> refresh the certs for a given server transparently, which includes
>> revoking the old ones, and publishing a new CRL file to all of my
>> servers, effectively making it impossible to use the old revoked
>> certs.
Davi> Makes sense.
<cut>
>> That's it. Now, the next issue I have with this code is that the CRL
>> file is read into memory and the contents stashed in the SSL context
>> data structures when SSL is initialized. Unlike the ca, cert, and key
>> files, which are re-read for each connection, the CRL file is only
>> read once. If the CRL file is updated, then it requires a restart of
>> mysqld to take effect. All of the other SSL-related config files are
>> read dynamically when a connection is made.
>>
>> That's just wrong -- if updating one file takes effect in realtime,
>> updating ALL of the SSL files should take effect in realtime.
>> Requiring a server restart is so... 20th century. I think it makes
>> sense to re-read the CRL file and stash it in the SSL context data
>> prior to the authentication of each SSL connection, to ensure that the
>> file is read dynamically. I'm not entirely sure WHERE this should be
>> done in the code.
Davi> It appears to be done in the right place. But it's all about trade offs,
Davi> there is a penalty in reading a file for every new connection..
I would prefer to keep the files in memory and have a call that will
force the files to be re-read. For example, when one does 'flush
privileges'.
It's not good to add the overhead of reading files for every connect.
Regards,
Monty
Check out MariaDB at http://mariadb.com
