Greetings,
Overall I'd like to see OpenSSH support PKI in addition to the existing
methods. I'm more keen on it being used for host authentication than
for user certificates, personally. I did want to comment on this
though:
* Daniel Hartmeier (daniel@benzedrine.cx) wrote:
> +Certkey does not involve online verfication, the CA is not contacted by
> either
> +client or server. Instead, the CA generates certificates which are (once)
> +distributed to hosts and users. Any subsequent logins take place without the
> +involvment of the CA, based solely on the certificates provided between
> client
> +and server.
Would you consider adding support for OCSP? I saw alot of
discussion regarding CRLs (and some of their rather well known
downsides) but only once saw mention of OCSP, and that with no response.
While CRLs are useful in some circumstances I believe OCSP is generally
a better approach. Ideally, both would be supported. If I had to pick
one I'd rather see OCSP than CRL support though.
Thanks,
Stephen
signature.asc
Description: Digital signature
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
|