Re: ZEO SSL support and Daft docs
Jim Fulton <[email protected]>
| Newsgroups | gmane.comp.web.zope.zodb |
|---|---|
| Message-ID | <CAPDm-Fjm4hVsRTE3GkSDwa4OGDRr80qFOQO4jAyAnj2XHTK4bQ@mail.gmail.com> |
On Thu, Jun 23, 2016 at 3:00 PM, Sean Upton <[email protected]> wrote: > > > On Thu, Jun 23, 2016 at 9:08 AM, Jim Fulton <[email protected]> wrote: >> >> On Wed, Jun 22, 2016 at 4:43 PM, Patrick Strawderman <[email protected]> >> wrote: >> > - It seems like clients can be configured to use the system's CA bundle, >> > but >> > the same is not mentioned in the description for the server's client >> > cert >> > configuration. Is that intentional? >> >> Did you ask this for the sake of symmetry? Or do you think there's a >> use case for a server wanting to allow clients with signed >> certificates, but without any other sort of authentication? >> > > I want to be able to authenticate with just a certificate, signed by a CA > trusted by the server. This is what I am doing for PostgreSQL SSL now for > RelStorage: > > https://github.com/upiq/plonebuild/blob/master/app/src/build/postgresql-ssl.rst#process-for-keys-and-certificates > > I suppose that this does not scale to "trust any CA" because my postgresql > setup assumes one CA, out-of-band, under my control. But this ought to be a > common enough assumption to support for small-ish set-ups. I'm not sure I understand this. Are you suggesting that a server should be willing to accept clients that have certificates signed by an external (system-defined) authority without any other information? Jim -- Jim Fulton http://jimfulton.info -- You received this message because you are subscribed to the Google Groups "zodb" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.