Re: problems getting rpc over tls to work

From: Chuck Lever III <chuck.lever@oracle.com>
To: Jeff Layton <jlayton@kernel.org>
Cc: "kernel-tls-handshake@lists.linux.dev"
	<kernel-tls-handshake@lists.linux.dev>
Subject: Re: problems getting rpc over tls to work
Date: Tue, 28 Mar 2023 14:04:21 +0000	[thread overview]
Message-ID: <430FEF8D-0953-4A24-9DC6-D53CFE211C05@oracle.com> (raw)
In-Reply-To: <87fea8b7313b08e9c5cb6af0ad0ce3774848cce3.camel@kernel.org>

> On Mar 28, 2023, at 8:55 AM, Jeff Layton <jlayton@kernel.org> wrote:
> 
> I wonder...should we have the ktls-utils package install a self-signed cert by default?

So this idea is intriguing, I had some similar thoughts.

I'm not sure what the security implications of all this are.
We'd first need to look at other certificate-based packages
in Fedora to see if they offer a similar quick-setup. The
cert would have to be created at install time.

> I created a self-signed
> cert and tried to use it, but the client rejects it with this:
> 
>    Mar 28 09:01:20 nfsclnt tlshd[1092]: Certificate signer not found.
> 
> Is there a way to make it not try to validate the cert chain?

Olga also found that self-signed server certs are not
working as we'd like. tlshd had a mechanism to force the
clients not to check the signer, but it was removed
because it was deemed insecure.

I'd like to find a way to make self-signed work seamlessly.

--
Chuck Lever