Re: [netconf] truststore usage in ietf-ssh/tls-client/server

[Kent Watsen <[e-mail]>]

Hi Balazs,


> 1.
>  
> In ssh-client and ssh-server:
>  
> "Indicates that the client can authenticate servers
> using the configured trust anchor certificates.";
>  
> "Indicates that the server can authenticate this user
> using the configured trust anchor certificates.";
>  
> Do you prefer ‘trust anchor’ or could it be changed to ‘certificate authority’?

Good question.  I was cognizant of the fact the the surrounding nodes and text uses CA (e.g., ca-certs).  But crypto-types uses the term "trust-anchor" (in contrast to "end-entity"), which seems more exact.  I was half-thinking to swap "ca-cert" for "trust-anchor" everywhere in the SSH and TLS models.  I think the result would be more consistent, but haven't looked carefully.  Thoughts?



>  2.
>                                                                        
> What’s the rationale of the new presence containers in ssh models but not in the tls models?

Good catch.  The examples didn't test this "case" and hence the issue was missed.  I added this to the TLS models here: https://github.com/netconf-wg/tls-client-server/commit/0eb86e7c9644cc396de7ab49037ed9ea40d5a75b <https://github.com/netconf-wg/tls-client-server/commit/0eb86e7c9644cc396de7ab49037ed9ea40d5a75b>.

FWIW, ts:local-or-truststore-certs-grouping contains a mandatory choice that was forcing the nodes to be defined all the time...



Kent // contributor