[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Nmh-workers] TLS certificate validation

From: Tom Lane
Subject: Re: [Nmh-workers] TLS certificate validation
Date: Sat, 24 Sep 2016 11:34:43 -0400

Ken Hornstein <address@hidden> writes:
> I've been poking around and I see that there is something that MIGHT
> be worthwhile to look at: something called "trust on first use" (TOFU)
> which basically replicates the SSH key model; upon first connection you
> decide to trust the certificate you get, and you save that for later.


> How this works when certificates expire is a little unclear to me;
> maybe you save the whole certificate chain and you decide to trust new
> certs that go back to the original root.

Look into what ssh does about it --- I don't recall having seen
expired-cert complaints from ssh, so I'm guessing they must deal with
this somehow.

> If this was enabled by default
> we'd get a lot better security out of the box.

Certainly better than no security.  For people who do want to deal
with their own certs, that could be the limiting case of the cert
already being present in the right place before first use.

                        regards, tom lane

reply via email to

[Prev in Thread] Current Thread [Next in Thread]