[saag] Re: pining a certificate/trust anchor
Viktor Dukhovni <[email protected]>
| Newsgroups | gmane.ietf.saag |
|---|---|
| Message-ID | <[email protected]> |
On Mon, Feb 10, 2025 at 11:59:14AM -0500, Michael Richardson wrote:
> Is there a document which does describe pinning?
> I'd hate to invent a contradictory or confusing definition.
FWIW, Postfix supports per-destination trust-anchor configuration, but
does not attempt to establish any concise terminology for the process
of creating such associations. One can configure a global set of
trust anchors that apply to all destinations, and override the system
trust store, or do that separately for each of a specific set of email
domains.
http://www.postfix.org/postconf.5.html#smtp_tls_trust_anchor_file
The trust anchors can be X.509 certificates or just public keys. So it
is possible to avoid needing a term like "pinning", which often evokes
fragile attempts to freeze the EE certificates of peers, and has been
abandoned as too brittle.
--
Viktor.
_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]