Re: help with OTP
Russ Allbery <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.general |
|---|---|
| Organization | The Eyrie |
| Message-ID | <[email protected]> |
Charles Hedrick <[email protected]> writes: > Anonymous PKINIT works fine but requires certs to be distributed. Unless > you're prepared to update every machine in the world every year, you > pretty much have to use a cert that goes back to a commercial CA. Because you have to distribute the certs to the client anyway, you can use self-signed certificates and set whatever expiration you want. There's the standard tradeoff of long certificate lifetime, but so far as I know there's no reason why you can't set your KDC public key certificate lifetime to 50 years or whatever. I agree with your other points, though. -- Russ Allbery ([email protected]) <https://www.eyrie.org/~eagle/> ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos