Closed sa-wilson closed 5 years ago
Thanks @sa-wilson :+1:
One question I have is if the verify_cn
option should be introduced at all or this should always happening when the Basic Station is using a client certificate. As I have not yet seen the Basic Station being used in production environments together with LoRa Server, I don't think introducing this validation would cause any trouble.
If I would make this integration again, I would make this CN validation mandatory :slightly_smiling_face:
I'm good with making CommonName validation mandatory with client certificates.
I was going for the "don't break anything" approach, but if you're fine with making that mandatory I think it's a good idea for security. Especially if you're going to the effort of setting up a CA and generating client certificates in the first place.
Adds support for #125 (Require certificate CommonName to match EUI for basic_station backend)
I've tested this locally with my own build of basic_station on a gateway and it doesn't appear to break regular TLS connections (with verify_cn set to false), or non-TLS connections.