4 ms·
Or it should be easier to supply an expected certificate Nearly all the time, the tool doesn't accept the certificate format or it wants a chain instead of jus
by lucb1e 2y ago
Or it should be easier to supply an expected certificate
Nearly all the time, the tool doesn't accept the certificate format or it wants a chain instead of just the root because the other side doesn't supply a chain or the CA bundle doesn't match the CA you used or it doesn't use the CA system at all or the fingerprint format is the wrong hash or it wants a file instead of just a command-line fingerprint or there isn't an "at least do TOFU" flag so for testing you resort to "okay then just accept everything"... it's very rarely smooth sailing from the point of "okay I'm ssh'd into the server, now what do I run here to give this tool something it can use to verify the connection"
Makes me think of how hard PGP is considered to be. Perhaps key distribution in any asynchronous cryptographic system is simply hard
- shermantanktop 2y agoKey distribution and revocation is pretty much the hard problem, at least in pragmatic terms. The details of cryptographic operations in code get a lot of scrutiny, and even then there are issues. But key management combines crypto complexity with distributed system complexity, and mixes that with human propensity for operational error.
- chx 2y ago> Makes me think of how hard PGP is considered to be https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- IshKebab 2y agoYeah the fact that on Linux the certificate bundle can be in literally 10 different locations depending on the distro is pretty embarrassing too.
- lyu07282 2y ago10? Ridiculous! We need to develop one universal standard that cover's everyone's usecases.
- TheSpiceIsLife 2y agoObligatory XKCD link
- fragmede 2y ago927. 9 is 3^2, 27 is 3^3