Documentation: Missing certifacate options in SimpleClientCertAuth

latchset / custodia

An API to manage secrets storage and retrieval

GNU General Public License v3.0

85 stars 27 forks source link

Documentation: Missing certifacate options in SimpleClientCertAuth #204

Open celestian opened 7 years ago

celestian commented 7 years ago

It could be little confusing that we cannot see notes about how to tell Custodia which certificate we would like to use.

tiran commented 7 years ago

Custodia currently accepts all valid client certificate that are trusted by the CA (global option tls_cafile). There is no additional filtering or support for CRL or OCSP status checks.

IMO we should recommend Apache mod_ssl or other TLS terminates to perform these checks for us.

simo5 commented 7 years ago