Re: Any advantage of using SSL with a certificate of authority?
От
Vick Khera
Тема
Re: Any advantage of using SSL with a certificate of authority?
Дата
Msg-id
CALd+dcfTdCBJiqHu=t8zzswkPW6SiGntaD=8rou3JT88dQimfg@mail.gmail.com
Ответ на
Re: Any advantage of using SSL with a certificate of
authority? (Bruce Momjian)
Список
Дерево обсуждения
Any advantage of using SSL with a certificate of authority? Jesus Rafael Sanchez Medrano <jesusrafael@gmail.com>
Re: Any advantage of using SSL with a certificate of
authority? Bruce Momjian <bruce@momjian.us>
Re: Any advantage of using SSL with a certificate of authority? Vick Khera <vivek@khera.org>
Re: Any advantage of using SSL with a certificate of
authority? Andrew Sullivan <ajs@crankycanuck.ca>
Re: Any advantage of using SSL with a certificate of authority? Robin <robinstc@live.co.uk>
Re: Any advantage of using SSL with a certificate of authority? John R Pierce <pierce@hogranch.com>
Re: Any advantage of using SSL with a certificate of
authority? Bruce Momjian <bruce@momjian.us>
Re: Any advantage of using SSL with a certificate of authority? Vick Khera <vivek@khera.org>
Re: Any advantage of using SSL with a certificate of authority? John R Pierce <pierce@hogranch.com>
Re: Any advantage of using SSL with a certificate of
authority? Bruce Momjian <bruce@momjian.us>
On Tue, Nov 26, 2013 at 1:31 PM, Bruce Momjian <bruce@momjian.us> wrote:
Well, by using a CA you are giving the CA rights to the key, while you
fully control a self signed key. Since you probably don't expect
unknown individuals to be connecting to your database, and self signed
key is recommended.
You never give the key to them, just a signing request based on the key. You lose no control over anything. They will in general insist your key be at least 2048 bits.
The only advantage of having a CA key is if the client does authentication of the server, and you have no prior arrangement with the client to accept a certificate from your signing authority.
Using self-signed certs you can give them longevity of 10+ years, so never have to worry about them again :)
В списке pgsql-general по дате отправления
От: Andrew Sullivan
Дата:
