4 ms·
> That is too much complexity for a single security-critical program. Looking at this x509 page, a lot of these options kind of seem like "required complexity"
by Beltalowda 4y ago
> That is too much complexity for a single security-critical program.
Looking at this x509 page, a lot of these options kind of seem like "required complexity" to me. There's a few things that aren't really needed (like the string conversion stuff) and a few things that could be condensed in one option (the "Print [..]" options can be one "print [list-of-fields]"), but those are relatively minor things.
The thing is, SSL/TLS is kinda complicated, but that's not really OpenSSL's fault.
- AdamH12113 4y agoSure, I'm willing to accept that the X.509 is inherently complicated and there's not much OpenSSL could do to simplify it. But that seems like a good reason not to add support for 44 other major operations to the software...
- Beltalowda 4y agoTLS is more than just x509. If you want a tool that "just generates certificates" then it's easy, but if you want an advanced management tool that can do all sorts of things then you will end up with something complex because TLS is complex with a lot of different parts. And yeah, the openssl tool could be designed a lot better, but much of this is a matter of UX and managing complexity, not so much reducing it.
- a2800276 4y agoWhy not? It's a collection of 44 tooks each doing one thing well :)
- Ekaros 4y agoAlso fun thing is that openssl doesn't even properly handle all of the cases and complexities of x509. Like subject altnames and what can be included in there by certain specifications and standards.