Re: TODO: GNU TLS

Tom Lane wrote:

>What basically bothers me about this is that trying to support both the
>OpenSSL and GNUTLS APIs is going to be an enormous investment of
>development and maintenance effort, because it's such a nontrivial thing
>  
>
Fascinating thread for the holidays. I found it interesting that nobody 
has mentioned
NSS (former Netscape SSL library). It has its own bag of problems of 
course, but
for me is potentially more attractive than GNU TLS. e.g. it has FIPS-140 
certification
and is actively under development by a software company with significant 
resources.
It's also very widely deployed. I'm not saying that OpenSSL is bad (it'd 
probably be my
first choice), just that there is another option besides GNU TLS.

BTW, if I may throw more gas on the licence debate flames -- the 
OpenLDAP client library
depends on OpenSSL, and almost everything depends on OpenLDAP (e.g. PAM, 
SASL,
any LDAP-enabled app). In 2003 Steven Frost submitted patches to the OL 
code to
add GNU TLS support, but as far as I can tell that code is still not in 
the current OpenLDAP
tree. Perhaps Steven could tell us what happened to that effort.