4 ms·
The point is you don't need a server-side fallback if you don't use Kerberos, since the server can validate login on its own. The fallback certificate is only
by dikei 7y ago
The point is you don't need a server-side fallback if you don't use Kerberos, since the server can validate login on its own.
The fallback certificate is only client-side, and can be keep offline/air- gap from the main credentials.
- kerng 7y agoYou have to provision the key for the fallback cert on server in both cases. So not sure why one would be better then the other...
- dikei 7y agoYou don't need to provision key for fallback cert on server, because the server simply trust all certificates that was signed by the CA. You only need to get the CA to sign the fallback cert.