NTS Wildcard Certificates

[Gary E. Miller]

Yo Richard!

On Mon, 18 Nov 2019 14:51:30 -0600
Richard Laager via devel <devel at ntpsec.org> wrote:

> On 11/18/19 2:36 PM, Gary E. Miller via devel wrote:
> > I would say another config option.  Both for client and server.  
> 
> I don't see why we would need a config option for the server. If you
> don't want a wildcard cert there, don't use one. If you do, do. No
> need to configure.

Fair enough.  If someone can swap the cert, they can certainly swap the
config.

> If someone wants an option to disable wildcard certs on the client,
> I'm not opposed, but it should default to having them enabled.
> Otherwise, interoperability as a client is compromised. The client
> would not be able to connect, by default, with e.g. "cloud
> deployments and large companies".

+1

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
	gem at rellim.com  Tel:+1 541 382 8588

	    Veritas liberabit vos. -- Quid est veritas?
    "If you can't measure it, you can't improve it." - Lord Kelvin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 851 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ntpsec.org/pipermail/devel/attachments/20191118/e741624a/attachment.bin>