search

titan-x / titan

Messaging server with mobile and browser support.
MIT License
2 stars 3 forks source link

Use intermediate server cert and OCSP #27

Closed soygul closed 8 years ago

soygul commented 9 years ago

Even it complicates things, use an intermediate server cert and let CA cert only have KeyUsageCertSign (KeyUsageDigitalSignature might also be required). Leave key encipherment, client/server validation, etc. key usage flags to the intermediate certificate.

Also publishing a CRL and using OCSP would be useful in case of a server cert is compromised.

soygul commented 8 years ago

Moved to: https://github.com/neptulon/neptulon/issues/39