Implement Sara's idea for moving away from PKIX gradually:

* Remove all KeyName elements from imported metadata * No longer ask for a KeyName to be added to certificates matching the remaining trust roots.
InCommon · Sep 5, 2012 · 3859625 · 3859625
1 parent 513aeca
commit 3859625
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/build/check_embedded.pl b/build/check_embedded.pl
@@ -353,7 +353,7 @@ sub comment {
 				$error = '';
 				comment("unknown issuer: $issuerCN");
 			} elsif ($clientOK) {
-				$error = "certificate matches trust fabric; add KeyName?";
+				# $error = "certificate matches trust fabric; add KeyName?";
 			}
 		}
 

diff --git a/mdx/uk/import.xsl b/mdx/uk/import.xsl
@@ -235,9 +235,9 @@
 	<!--
 		ds:KeyName
 		
-		Remove empty KeyName elements.
+		Remove KeyName elements.
 	-->
-	<xsl:template match="ds:KeyName[.='']">
+	<xsl:template match="ds:KeyName">
 		<!-- do nothing -->
 	</xsl:template>