Re: ZEO SSL support and Daft docs

On Thu, Jun 23, 2016 at 8:08 AM, Jim Fulton <[email protected]> wrote:

> On Wed, Jun 22, 2016 at 4:43 PM, Patrick Strawderman <[email protected]>
> wrote:
> > - It seems like clients can be configured to use the system's CA bundle,
> but
> > the same is not mentioned in the description for the server's client cert
> > configuration. Is that intentional?
>
> Did you ask this for the sake of symmetry?  Or do you think there's a
> use case for a server wanting to allow clients with signed
> certificates, but without any other sort of authentication?


Mostly for the sake of symmetry. However, I do think larger organizations
with 100s or 1000s of encrypted services are probably going to use an
internal CA to sign/verify certificates. They could distribute the custom
CA cert by baking it into an AMI, for instance. However, I'm mostly in
favor of explicitly supplying certs in the application, instead of relying
on the system to have the appropriate certs, and for the ssl module to even
locate them properly (no error is raised if the system certificate bundle
can't be found).

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.