search for: spyrus

I have played with self-signed end-use PKI certificates for about a decade now and would really like to set up a proper, albeit private, PKI using some sort of OFS CA management software. I have looked at OpenCA and found a few packages on sourceforge but they all seem to fall short of my desires in one form or another (rpm install, multiple subordinate CAs, certificate revocation and extension

...suggesting this might happen http://marc.info/?l=openssh-unix-dev&m=131501200216440&w=2 and there's also a mention in this talk http://www.openbsd.org/papers/asiabsdcon2011_openssh_whats_new.pdf but I can find no evidence that anything has been implemented yet. The hardware I am using (Spyrus Lynks II) doesn't have PKCS#11 support, so I would prefer the OpenSSL route (since I already have an engine), but if necessary I would consider writing a minimal PKCS#11 implementation (can anyone give a rough idea of the amount of work involved to get HostKey working, only?) Anyway, any point...