You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello,
The current support TLS in nats.c based exclusively on OpenSSL has certain concerns on Windows, such as:
no integration with the Windows certificate store out-of-the-box (I can workaround it by loading all certificates myself into natsOptions_SetCATrustedCertificates but I'm still not sure about reliability of this approach)
OpenSSL is not available on Windows, so we need to ship our own build of OpenSSL in our product's installer, which might complicate (or even make impossible) the audit for STIG or FIPS 140-2 etc
These drawbacks can be avoided if nats.c includes an alternative TLS implementation using Windows Schannel Security Service Provider - something like this example, I suppose. Git is a notable example of an application that supports both OpenSSL and Schannel backends.
I realize that this work might be far beyond your commitment, so I'm raising this enhancement issue to ask, whether you would accept a PR with this implementation.
The text was updated successfully, but these errors were encountered:
Hello,
The current support TLS in nats.c based exclusively on OpenSSL has certain concerns on Windows, such as:
natsOptions_SetCATrustedCertificates
but I'm still not sure about reliability of this approach)These drawbacks can be avoided if nats.c includes an alternative TLS implementation using Windows Schannel Security Service Provider - something like this example, I suppose. Git is a notable example of an application that supports both OpenSSL and Schannel backends.
I realize that this work might be far beyond your commitment, so I'm raising this enhancement issue to ask, whether you would accept a PR with this implementation.
The text was updated successfully, but these errors were encountered: