Subject: PSARC FastTrack [04/27/2006]: Certificate chain support in kernel SSL


Template Version: @(#)sac_nextcase 1.56 10/26/05 SMI
1. Introduction
    1.1. Project/Component Working Name:
	 Certificate chain support in kernel SSL
    1.2. Name of Document Author/Supplier:
	 Author:  Krishna Yenduri
    1.3  Date of This Document:
	20 April, 2006
4. Technical Description

Title: Certificate chain support in kernel SSL

The interface taxonomy is Evolving.
Release binding is micro/patch. The man
page diffs are in the case directory.

Problem:
--------
The kernel SSL project (PSARC 2002/557 and PSARC 2005/625)
introduced an administrative command, ksslcfg(1M). This
command currently does not support certificate chain
for the server certificate.

We need this functionality as there is a customer
escalation for it (See 5106865 cert chain support is needed in kernel SSL).


Solution:
---------
The following changes are proposed to ksslcfg (1M).

1. The file, key_and_certificate_file, in
	ksslcfg create -f pem -i <key_and_certificate_file> ...
	and
	ksslcfg create -f pkcs12 -i <key_and_certificate_file> ...
	
can now take intermediate CA certificates which form the
certificate chain to the root CA for the server certificate.

The order must be the order that is followed in Apache ssl.conf
i.e.
 <server_cert> <middle_level_ca_cert> <next_level_ca_cert>...

2. A new option [-h <ca_certchain_file>] is added
for ksslcfg create -f pkcs11.

A new option is needed as there is no API to build a certificate
chain given a certificate in a PKCS#11 key store. An RFE is filed
 6407962 need a routine to get certificate chain given a
         certificate in a PKCS #11 key store

We need an immediate solution though to address the customer need.
Hence the new option is proposed instead of waiting for
RFE 6407962 to be done as part of KMF project.

The file, ca_certchain_file, is in PEM format. We chose
PEM format because it is a format used by the
Sun Java System web server to import certificates in to
its PKCS#11 key store. It is also the default certificate format
for the Apache webserver.

6. Resources and Schedule
    6.4. Steering Committee requested information
   	6.4.1. Consolidation C-team Name:
		ON
    6.5. ARC review type: FastTrack