Re: Re: SSL authentication requirements(?)

On Fri, Jul 1, 2016 at 6:28 PM, Bill Janssen <[email protected]> wrote:
> There are a number of things to achieve with the SSL encoding.
> Authentication (both client and server) are (is?) one of them.  Privacy is
> another, and doesn't require cert verification on either side.  I think it
> makes sense to have 3 levels:  privacy only (server doesn't demand client
> cert and client doesn't verify server cert, so server can use a self-signed
> cert), server authentication (client verifies server cert, so server cert
> must be from a trust chain known to the client), and client authentication
> (server verifies client cert, so client cert must be from a trust chain
> known to the server).  Each of these is useful independently, I think.

I thought so too, but in the discussion, there seemed to be a
consensus that for ZEO, there wasn't much point in having SSL if
parties aren't authenticated.  I'm inclined to keep the default rather
conservative, but I'd be happy to add options to disable cert
verification.

Note that this discussion only applies if you're using the
configuration language. If clients or servers are created in Python,
it's up to you to create an SSLContext, so you have complete control.

Jim

-- 
Jim Fulton
http://jimfulton.info

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.