Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Alternative TLS implementation using WinAPI Schannel #646

Open
Kazmirchuk opened this issue Apr 3, 2023 · 1 comment
Open

Alternative TLS implementation using WinAPI Schannel #646

Kazmirchuk opened this issue Apr 3, 2023 · 1 comment

Comments

@Kazmirchuk
Copy link

Kazmirchuk commented Apr 3, 2023

Hello,
The current support TLS in nats.c based exclusively on OpenSSL has certain concerns on Windows, such as:

  • no integration with the Windows certificate store out-of-the-box (I can workaround it by loading all certificates myself into natsOptions_SetCATrustedCertificates but I'm still not sure about reliability of this approach)
  • OpenSSL is not available on Windows, so we need to ship our own build of OpenSSL in our product's installer, which might complicate (or even make impossible) the audit for STIG or FIPS 140-2 etc

These drawbacks can be avoided if nats.c includes an alternative TLS implementation using Windows Schannel Security Service Provider - something like this example, I suppose. Git is a notable example of an application that supports both OpenSSL and Schannel backends.

I realize that this work might be far beyond your commitment, so I'm raising this enhancement issue to ask, whether you would accept a PR with this implementation.

@Kazmirchuk
Copy link
Author

Kazmirchuk commented Aug 7, 2023

any opinion on this?
btw I noticed support for Windows certificate store in the NATS roadmap as well

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant