mech_eap: libeap tls-_internal does not support hash://server/sha256

[Sam Hartman]

 affects moonshot

The portal generates credentials that use a sha256 of the server
certificate.
This is probably what we want.

Unfortunately the libeap's tls_internal doesn't actually support that.
Only openssl's libeap driver supports this.

Moving to openssl complicates windows builds in the non-SSP case.

In addition for this to work right we need to move away from schannel
builds for the SSP.

This bug requires more discussion and a real plan.

 importance critical

[Luke Howard (lukeh-padl)]

> In addition for this to work right we need to move away from schannel
> builds for the SSP.

How come? A lot of work went into getting this to work right :-) It supports locating certificates by SHA256 hash.

-- Luke

[Sam Hartman (hartmans)]

>>>>> "Luke" == Luke Howard <email address hidden> writes:

Ah, did the changes for adding sha256 certificates not get pushed out of
the ssp repo?
I only grepped for server/sha256 in the public repo.

--Sam

[Luke Howard (lukeh-padl)]

> Ah, did the changes for adding sha256 certificates not get pushed out of
> the ssp repo?
> I only grepped for server/sha256 in the public repo.

They did not get pushed out of the SSP repository. It's a slightly newer libeap in the SSP repository too as I recall, but I also rewrote large chunks of tls_schannel.c.

-- Luke