Re: ZEO SSL support and Daft docs

On Thu, Jun 23, 2016 at 9:08 AM, Jim Fulton <[email protected]> wrote:

> On Wed, Jun 22, 2016 at 4:43 PM, Patrick Strawderman <[email protected]>
> wrote:
> > - It seems like clients can be configured to use the system's CA bundle,
> but
> > the same is not mentioned in the description for the server's client cert
> > configuration. Is that intentional?
>
> Did you ask this for the sake of symmetry?  Or do you think there's a
> use case for a server wanting to allow clients with signed
> certificates, but without any other sort of authentication?
>
>
I want to be able to authenticate with just a certificate, signed by a CA
trusted by the server.  This is what I am doing for PostgreSQL SSL now for
RelStorage:

https://github.com/upiq/plonebuild/blob/master/app/src/build/postgresql-ssl.rst#process-for-keys-and-certificates

I suppose that this does not scale to "trust any CA" because my postgresql
setup assumes one CA, out-of-band, under my control.  But this ought to be
a common enough assumption to support for small-ish set-ups.

Sean

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.