Re: X.509 and ssh

"Richard E. Silverman" <res@xxxxxxxx> wrote in message
news:m2pslto3v8.fsf@xxxxxxxxxxxxxxxxxxxxx

With a standard, distributed trust system such as X.509 PKI, this problem
simply goes away. It is only necessary to distribute to clients, once, a
single root certificate under which server hostkey certificates are
issued. Servers may then be added, removed, or rekeyed at will, with no
client updates needed. Similar improvements are realized if certificates
are also used for user authentication, although that entails much more
overhead and hence is less likely to be necessary or used.

I would like to use it the other way around. All users presenting a X.509
certificate issued by a trusted party can access the server. Then I only
need to install the root certificate of the trusted party on the server and
the user management doesn't need to be done on that server but can be done
independently.

Jan


.

Relevant Pages

  • RE: 802.1x Authentication Fails
    ... Reason = The authentication request was not processed because the ... a default certificate is being sent to ... I queried the product team about this and they feel the server certificate ... which is causing the problem that the clients cannot ...
    (microsoft.public.internet.radius)
  • Re: Can this be done? Wireless Access w/o the use if CERTs
    ... a default certificate is being sent to user ... Could not retrieve the Remote Access Server's certificate due to the ... to use EAP-TLS but you don't have a server certificate. ... EAP-TLS requires certificates on clients and on the IAS server. ...
    (microsoft.public.internet.radius)
  • Re: trouble using SSL on WSUS
    ... clients according to the deployment guide. ... I configured the client to use the WSUS server through https. ... Schemes used: ... I've read on serveral sites that the server certificate has to be imported ...
    (Focus-Microsoft)
  • Re: Basic WEP/RADIUS/802.11 (Cisco/MS) question
    ... but I am interested in this whole Radius ... > I see that I can pull a Radius server out of the Microsoft Windows ... Cisco 1200 APs would be the RADIUS clients. ... a third party CA for your server certificate that your clients already ...
    (microsoft.public.internet.radius)
  • Re: subtext search in encrypted text
    ... > * clients access the system by communication with a application server ... both a client certificate and a server certificate. ... How secure is the memory of the phone? ...
    (sci.crypt)