Cert pinning

[Gary E. Miller]

Yo Richard!

On Thu, 28 Mar 2019 18:36:54 -0500
Richard Laager via devel <devel at ntpsec.org> wrote:

> On 3/28/19 6:26 PM, Hal Murray via devel wrote:
> > 
> > Gary said:  
> >>> There is a downside. Every time it changes, you have to take
> >>> a leap of faith when you re-pin it, rather than getting normal
> >>> CA validation.  
> >> You miss the point, this is addition to normal CA validation, not
> >> an alternative to it.  Just like HPKP.   
> > 
> > I'm missing something important.  Why would I need additional
> > validation? Isn't normal certificate validation good enough?  
> 
> In normal validation, ANY root CA can sign a certificate for my domain
> and it will be trusted by clients.

Yes, a bad thing.  Why DANE and HPKP were invented.

> I might want to pin the NTS association for ntp1.wiktel.com to require
> that its certificate be issued by Let's Encrypt. Or, I might want to
> pin it to my internal CA.

Yup.  Now you're getting it.  Thus the 4 DANE types.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
	gem at rellim.com  Tel:+1 541 382 8588

	    Veritas liberabit vos. -- Quid est veritas?
    "If you can’t measure it, you can’t improve it." - Lord Kelvin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 851 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ntpsec.org/pipermail/devel/attachments/20190328/6b42ab78/attachment-0001.bin>