Re: [Ntp] Getting started using NTS -- clock accuracy vs certificates

[Danny Mayer <[e-mail]>]

I forgot to add that you should not be using IP addresses in your 
configuration of NTP Servers. Addresses can and will change and those 
servers can be retired. The example of the Australian server being 
retired and the address continuing to be bombarded with NTP requests for 
years afterwards comes to mind. Publicly available NTP servers are at 
the whim of the operators of those servers.

Danny

On 8/2/22 9:39 AM, Danny Mayer wrote:
>
> On 8/2/22 5:24 AM, Miroslav Lichvar wrote:
>> On Mon, Aug 01, 2022 at 02:06:37PM -0700, Hal Murray wrote:
>> Using the numerical IP address as the "host name" in the certificate 
>> would
>>> avoid the DNSSEC tangle.  That seems like a reasonable convention 
>>> for long
>>> lived certificates.
>> Yes, including the IP address as a Subject Alternative Name in the
>> certificate could be a very useful feature.
> Not really. IP addresses are not a reliable constant. You don't avoid 
> the DNSSEC tangle because DNSSEC needs accurate time (relatively 
> speaking) to work at all. This is the bootstrap problem.
>
>
> Danny
>