Re: Confirm decision on identity handling.

[Eric Rescorla <ekr@rtfm.com>]

Michael Thomas <mat@cisco.com> writes:
> But that doesn't imply that has to be done in
> every scenario. Suppose I set up a service at to
> view pictures on a protected web site. I issue
> certificates to my friends which allows them past
> the IPsec barrier on my web server host. I don't
> care who they are -- just that it's somebody who I
> issued a cert to -- and most especially don't care
> where they happen to have internet connectivity at
> the time.
> 
> Are you saying this is an illegitimate use of
> IPsec/IKE?
No, but I'd like to see the more complete case specified
and the case you're describing as a less complete variation
rather than simply ignoring the complete case as people
seem wont to do.

-Ekr

-- 
[Eric Rescorla                                   ekr@rtfm.com]
                http://www.rtfm.com/