Hannes Tschofenig <hannes.tschofe...@arm.com> wrote: > > We want all our clients to be authenticated by DTLS before they start > > loading up our RF network. > > I'm not suggesting that the DTLS be skipped, I'm suggesting that the > > client certificate presented might be meaningless to the EST server.
> I am curious what security model you have in mind? If you don't do client > authentication then you are essentially issuing certificates to an > anonymous entity. This feels like a very bad idea, particularly since the > CA is supposed to assert the identifier of the client via the certificate. Clients which are not **yet** authenticatable. The client shows up, does a DTLS connection. We let the DTLS connection succeed, because we want to record the particulars of the client, so we can ask a human. Much like happens when you ssh to a new host: it stops to ask if you you agree with the key. You don't know, so you hit ^C. So, that's all. We don't intend to issue certificates... yet. I'm also asking if there is some use case where the client might legitimate need the list of trust anchors (/cacerts request) in order so that it can...? (I couldn't think of a use case) -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =-
signature.asc
Description: PGP signature
_______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace
