Re: problems getting rpc over tls to work

[Jeff Layton <jlayton@kernel.org>]

On Tue, 2023-03-28 at 13:55 +0000, Chuck Lever III wrote:
> 
> > On Mar 28, 2023, at 9:29 AM, Chuck Lever III <chuck.lever@oracle.com> wrote:
> > 
> > 
> > 
> > > On Mar 28, 2023, at 8:27 AM, Jeff Layton <jlayton@kernel.org> wrote:
> > > 
> > > Hi Chuck!
> > > 
> > > I have started the packaging work for Fedora for ktls-utils:
> > > 
> > >   https://bugzilla.redhat.com/show_bug.cgi?id=2182151
> > > 
> > > I also built packages for this in copr:
> > > 
> > >   https://copr.fedorainfracloud.org/coprs/jlayton/ktls-utils/
> > > 
> > > ...and built some interim nfs-utils packages with the requisite exportfs
> > > patches:
> > > 
> > >   https://copr.fedorainfracloud.org/coprs/jlayton/nfs-utils/
> > 
> > Note that the nfs-utils changes aren't necessary to support
> > the kernel server in "opportunistic" mode -- the server will
> > use RPC-with-TLS if a client requests it, but otherwise does
> > not restrict access.
> > 
> > Client side also has no nfs-utils requirements at this time,
> > since the new mount options are handled by the kernel.
> 
> In case I wasn't clear:
> 
> This was meant as a suggestion. If you want to simplify your
> test set-up a bit, the nfs-utils piece isn't needed at this
> point. But feel free to include it if you like!
> 

Understood. I needed to build it for the server side anyway, so I
figured I might as well. Eventually I'd like to set up a Fedora COPR
repo that has all of the packages we need to test this, but I need to
sort through the certificate handling here first.

Are there docs on how to administer gnutls? For instance, I guess I'll
want to set up my own CA and issue client and server certs. How do I
make gnutls trust a new CA?
--
Jeff Layton <jlayton@kernel.org>