3 ms·
Very much agreed. While for simple use cases static keys are more than fine, a proper PKI is basically the only sane way to deploy a VPN in an enterprise or eve
by q3k 7y ago
Very much agreed. While for simple use cases static keys are more than fine, a proper PKI is basically the only sane way to deploy a VPN in an enterprise or even small company setting.
- megous 7y agoWhat do you mean by static keys? All keys are changeable at runtime and wireguard uses public key cryptography.
- q3k 7y agoThat all clients have to be configured on each server.
- megous 7y agoServer has to know what clients to accept in any VPN solution. I still don't see the point.
- q3k 7y ago> Server has to know what clients to accept in any VPN solution. I still don't see the point. In OpenVPN and others, the server can just check the certificate presented by a client against a shared CA. The certificate can be signed/emitted by a totally different system.
- namibj 7y agoWireguard doesn't respond at all (not SYN/ACK stuff) if not provided with a correctly signed packet. This means you can't scan for wireguard ports without already being configured for them.
- megous 7y agoI see. Though if you ever want to remove access you'll still not avoid distributing information about individual clients to the VPN servers. It will just be a blacklist style list and not a whitelist like in WG.