[Galene] Re: Heads up: Galène generates self-signed certificates

[Dave Taht <dave.taht@gmail.com>]

Several notes.

I strongly agree with being able to generate a self signed cert.
Especially if you are operating a server that is off the internet,
it's difficult to get a cert via let's encrypt,
and asking folk to run the openssl command line is just asking for trouble.

The CA authority argument has always smelt of the old key escrow argument, and
I vastly prefer to not register some things with any centralized
authority and explain to potential users that's why it isn't
registered and that the "invalid cert" thing is misleading.

I however wouldn't mind if that there was a command within galene to
fire off the lets encrypt facility if a box is on the public internet
and has working dns. shell out to acme, I think....

On Wed, Feb 24, 2021 at 1:25 PM Juliusz Chroboczek <jch@irif.fr> wrote:
>
> >> If at least one of cert.pem and key.pem are present
>
> > Currently, we fall back to the self-signed certificate if either of the
> > two files is missing.  Could you please describe the kind of attacks that
> > you're worried about?
>
> I've changed the behaviour in that case -- we'll fail the connection if
> only one of the two files exists.
> _______________________________________________
> Galene mailing list -- galene@lists.galene.org
> To unsubscribe send an email to galene-leave@lists.galene.org



-- 
"For a successful technology, reality must take precedence over public
relations, for Mother Nature cannot be fooled" - Richard Feynman

dave@taht.net <Dave Täht> CTO, TekLibre, LLC Tel: 1-831-435-0729