4 ms·
in fact openssh has support for full-blown certificates but its also a little more painful. what makes ssh easy to use is that it doesn't have any central trust
by zobzu 13y ago
in fact openssh has support for full-blown certificates but its also a little more painful. what makes ssh easy to use is that it doesn't have any central trust authority by default.
you get a fingerprint and you trust it.
if it changes, it warns you.. but in most cases you're going to know why it changed or just accept the change anyway (which is a problem when you admin 10000 servers of course as the warning might be a real issue)
central trust/revocation is still an issue everywhere to this day, i think. both technically ("my client trusts this, but do i?") and from the useability pov.
- e12e 13y ago> openssh has support for full-blown certificates Well, yes and no. Do you mean the new cert stuff that's in standard openssh? Which has stuff like: The marker is optional, but if it is present then it must be one of “@cert-authority”, to indicate that the line contains a certification authority (CA) key, or “@revoked”, to indicate that the key contained on the line is revoked and must not ever be accepted. Only one marker should be used on a key line. While certainly simple, it doesn't strike me as very manageable. Or did you mean the x509 patch? http://roumenpetrov.info/openssh/ http://roumenpetrov.info/openssh/