Motivation:

For HTTP-TPC, the checking of Subject DN makes no sense, as the identity
being asserted by the EEC is the DNS name of the host.

Modification:

Add configation option to allow different checking modes, as supported
by the CaNL library.  The default option, if none specified, is the
existing mode `EUGRIDPMA_AND_GLOBUS_REQUIRE`, providing backwards
compatibility.

Result:

No user or admin visible changes by default.  StoRM-WebDAV now supports
an admin configuring the namespace checking mode via:

    storm:
	tls:
            namespace-checking-mode: IGNORE

Closes: italiangrid#65

Motivation:

Namespace checking rejects certificates if the subject DN is not one of
the allowed values for that certificate's CA.  A list of allowed subject
DNs is maintained by IGTF for their trust store.

There are two problems with this approach.

  1. it is IGTF specific.  There is no equivalent for CA/B, making
     interoperability with CA/B-approved CAs non-trivial.

  2. for HTTP-TPC, the check is pointless.  It protects the
     certificate's Subject DN, which plays no role in the identity of
     the remote site.  Instead, the X.509 v3 Subject Alternative Name is
     used, instead.

Modification:

Update the SSLContext (which includes the certificate chain validation)
for the Apache HTTP client.  There is (no longer) any namespace checking
for such certificates.

Note that the namespace checking for client X.509 certificates (which is
the intended target of namespace checking) is unaffected by this change.

Result:

HTTP-TPC now works with remote sites that have a CA/B certificate and
using the system standard trust store.

Closes: italiangrid#65

Motivation:

Namespace checking rejects certificates if the subject DN is not one of
the allowed values for that certificate's CA.  A list of allowed subject
DNs is maintained by IGTF for their trust store.

There are two problems with this approach.

  1. it is IGTF specific.  There is no equivalent for CA/B, making
     interoperability with CA/B-approved CAs non-trivial.

  2. for HTTP-TPC, the check is pointless.  It protects the
     certificate's Subject DN, which plays no role in the identity of
     the remote site.  Instead, the X.509 v3 Subject Alternative Name is
     used, instead.

Modification:

Update the SSLContext (which includes the certificate chain validation)
for the Apache HTTP client.  There is (no longer) any namespace checking
for such certificates.

Note that the namespace checking for client X.509 certificates (which is
the intended target of namespace checking) is unaffected by this change.

Result:

HTTP-TPC now works with remote sites that have a CA/B certificate and
using the system standard trust store.

Closes: italiangrid#65