<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:st1="urn:schemas-microsoft-com:office:smarttags"><head><META content="text/html; charset=utf-8" http-equiv="Content-Type">
<STYLE><!-- /* Style Definitions */ p.77636e41-5e51-4834-aac3-df5fee807777, li.77636e41-5e51-4834-aac3-df5fee807777, div.77636e41-5e51-4834-aac3-df5fee807777, table.77636e41-5e51-4834-aac3-df5fee807777Table {margin:0cm; margin-bottom:.0001pt;}div.Section1 {page:Section1;}--></STYLE>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META content="MSHTML 8.00.6001.18975" name=GENERATOR></head><BODY>
<P CLASS="77636e41-5e51-4834-aac3-df5fee807777"><FONT FACE="Arial" SIZE="2">
<DIV align=left dir=ltr><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011></SPAN></FONT> </DIV><FONT color=#0000ff face=Arial size=2></FONT><BR>
<BLOCKQUOTE style="BORDER-LEFT: #0000ff 2px solid; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px">
<DIV></DIV><FONT color=#0000ff face=Arial size=2></FONT><BR><BR>
<DIV class=gmail_quote>2011/1/10 Arjen de Korte <SPAN dir=ltr><<A href="mailto:nut%2Bdevel@de-korte.org">nut+devel@de-korte.org</A>></SPAN><BR></DIV>
<BLOCKQUOTE class=gmail_quote style="BORDER-LEFT: rgb(204,204,204) 1px solid; MARGIN: 0pt 0pt 0pt 0.8ex; PADDING-LEFT: 1ex">Citeren <A href="mailto:EmilienKia@Eaton.com">EmilienKia@Eaton.com</A>:<BR><BR>
<DIV class=im>
<BLOCKQUOTE class=gmail_quote style="BORDER-LEFT: rgb(204,204,204) 1px solid; MARGIN: 0pt 0pt 0pt 0.8ex; PADDING-LEFT: 1ex">The main reason is to homogenize directive names between
apps (mainly upsmon which uses CERTPATH and upsd which uses CERTNAME) to
set the same property.<BR></BLOCKQUOTE></DIV>Why? The use of CERTFILE
(OpenSSL only) and CERTPATH/CERTIDENT/CERTREQUEST (NSS only) is completely
different. We have nothing to gain by reducing the number of directives
here, since we will need different instructions on how to fill them
anyway.<BR><BR>Using different names will help us help people much more
easily, since the directives they see in upsd.conf will already tell us if
NUT was build to use the OpenSSL or NSS libraries.<BR><BR>
<DIV class=im>
<BLOCKQUOTE class=gmail_quote style="BORDER-LEFT: rgb(204,204,204) 1px solid; MARGIN: 0pt 0pt 0pt 0.8ex; PADDING-LEFT: 1ex">As ssl support compilation is exclusive (only openssl or
nss at the same time), I do not see any reason to keep two directives in
parallel (one per compile profile) doing the same thing (pointing to the
certificate database, in the form of a single file or a
directory).<BR></BLOCKQUOTE></DIV>These should be surrounded by
#ifdef/#endif directives and make upsd complain loudly about directives it
doesn't understand. So if someone is accidentally using CERTFILE if NUT was
build with NSS, it should inform them right away (not when the certificate
store is being accessed). Similar the other way around.<BR><BR>
<DIV class=im>
<BLOCKQUOTE class=gmail_quote style="BORDER-LEFT: rgb(204,204,204) 1px solid; MARGIN: 0pt 0pt 0pt 0.8ex; PADDING-LEFT: 1ex">About configuration directive, only CERTFILE/CERTPATH
change of content (a directory instead of a file) but the semantic is kept
unchanged. All other SSL related directives are just for NSS mode. So
generate different .conf.sample files is IMHO disproportionate related to
the too few alterations. Perhaps add few lines of comment in these
.conf.sample files?<BR></BLOCKQUOTE></DIV>You forget about the amount of
problems we will see when people start switching over from OpenSSL to NSS.
There is pretty much nothing to gain by consolidating these directives into
one. What's wrong with<BR><BR># CERTFILE <certificate file> (OpenSSL
only)<BR># CERTFILE /usr/local/ups/etc/upsd.pem<BR><BR># CERTPATH
<certificate directory> (NSS only)<BR># CERTPATH
/usr/local/ups/etc/cert/upsd<BR><BR># CERTIDENT <certificate name>
<database password> (NSS only)<BR># CERTIDENT "my nut server"
"MyPasSw0rD"<BR><BR># CERTREQUEST <certificate request level> (NSS
only)<BR># CERTREQUEST [0|1|2]<BR># - 0 to not request to clients to
provide any certificate<BR># - 1 to require to all clients a
certificate<BR># - 2 to require to all clients a valid
certificate<BR><BR>valid points!<BR><BR>Emilien, can you please adapt the
code as per the above.<BR>I'll check how we can condition the conf sample
and <SPAN class=short_text id=result_box lang=en><SPAN class=hps title="Cliquer ici pour voir d'autres traductions">highlight the SSL support
type in the doc.<BR><BR></BLOCKQUOTE></BLOCKQUOTE>
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011>Done in r2817.</SPAN></FONT></DIV>
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011></SPAN></FONT> </DIV>
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011>What about CERTPATH in upsmon.conf
?</SPAN></FONT></DIV>
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011></SPAN></FONT> </DIV>
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011>BR</SPAN></FONT></DIV>
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011></SPAN></FONT><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011>Emilien</SPAN></FONT></DIV>
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011></SPAN></FONT> </DIV>
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011></SPAN></FONT> </DIV>
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011>PS :
<DIV align=left class=gmail_quote><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011></SPAN></FONT><FONT color=#0000ff face=Arial size=2><SPAN class=708425412-11012011>It seems f#####k Outlook send this
message without my response, really sorry for the
noise.</SPAN></FONT></DIV></SPAN></FONT></DIV></SPAN></SPAN> </FONT></P>
<P CLASS="77636e41-5e51-4834-aac3-df5fee807777"><SPAN STYLE="FONT-SIZE: 11pt; COLOR: red; FONT-FAMILY: 'Calibri','sans-serif'"><SPAN LANG="EN-US" STYLE="FONT-SIZE: 11pt; COLOR: #1f497d; FONT-FAMILY: 'Calibri','sans-serif'"><FONT COLOR="#0000ff" SIZE="2"><SPAN LANG="EN-US" STYLE="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'"><SPAN STYLE="COLOR: #1f497d"><SPAN STYLE="FONT-SIZE: 10pt; COLOR: blue; FONT-FAMILY: Arial"><FONT COLOR="#999999">
<HR>
<FONT SIZE="1"></FONT></FONT></SPAN><SPAN STYLE="COLOR: blue"></SPAN>
<P></P></SPAN></SPAN></FONT></SPAN></SPAN>
<P></P></P></BODY></HTML>