[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Reliable delete notifies
>. it is a matter of education. IKE is still too new to be understood.
>. PKI vendors need to come with something veeeeery simple (click click click,
>no ldap, no tons of passwords, no tons of roles and everything).
>. Enrollment protocols are an extra complexity (for the challenged). it should
> always be possible to copy-paste the certs.
Fred, I think you're exactly right.
It's interesting that (two of) the free implementations (FreeS/WAN and OpenBSD)
are actually arguing for public key authentication exclusively. FreeS/ WAN uses
OpenSSL, OpenBSD uses both OpenSSL and KeyNote for certificates -- both do not
in fact require any type of infrastructure to use the certificates, and both
allow cut-and-paste. Unfortunately, it's still not simple to generate those
certs...
Having to interoperate with the commercial PKI vendors has always been a pain,
because they each have non-intuitive ways of importing or exporting certs
(some require LDAP or other brain-dead schemes).
-Angelos
References: