Re: [TICTOC] [ntpwg] security ID submitted for review

[Kurt Roeckx <[e-mail]>]

On Sat, Aug 03, 2013 at 07:40:08PM +0200, Kurt Roeckx wrote:
> 
> I really don't understand how such a man in the middle attack
> can work.  Either the certificate + the chain validate, or they
> don't.  It is of course important to you check that the CommonName
> in the certificate matches the server you're trying to reach,
> and that the root CA is in your list of trusted CAs.  But there
> really isn't anything new or hard about this.

So thinking about this so more, I do see 1 problem with this.  I
would like to be able to use this for the pool for those that wish
to use it.  But if you're verify the certificate you're not going
to know which server you're talking too, so there is no way to
check the CommonName.  Does it make sense to just skip this
check in case of the pool?


Kurt