[Freeipa-devel] [PATCH] 242 new method to identify CAs to trust

[Jason Gerard DeRose]

On Thu, 2009-07-23 at 17:57 -0400, Rob Crittenden wrote:
> A new way to identify the CAs to trust when importing a PKCS#12 file 
> (like during replica installation). We used to use certutil -O but 
> Fedora 11 changed certutil so it doesn't show untrusted CAs (the whole 
> point of running the command).
> 
> Instead parse the output of pk12util -l to find the nicknames of the CAs 
> to trust.
> 
> rob

The code looks fine, but I can't get it to apply.