diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2014-12-04 18:39:28 +0000 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2014-12-04 18:39:28 +0000 |
| commit | 3750d68d17a77fe0d51906e49fc09e24c5864a29 (patch) | |
| tree | e82c80c94e72bd3ccac06bdff95b072deea4b403 /doc/doc-txt | |
| parent | 281e72e46c44d316d47ed309dcb0d781a909a181 (diff) | |
Docs: clarify interaction of DANE and CA-based certificate verification options
Diffstat (limited to 'doc/doc-txt')
| -rw-r--r-- | doc/doc-txt/experimental-spec.txt | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index d57cbf903..c3e1196b4 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -1302,12 +1302,13 @@ MX, A and TLSA records. A TLSA lookup will be done if either of the above options match and the host-lookup succeded using dnssec. -If the TLSA lookup succeeds, a TLS connection will be required -for the host. +If a TLSA lookup is done and succeeds, a DANE-verified TLS connection +will be required for the host. (TODO: specify when fallback happens vs. when the host is not used) -If dane is in use the following transport options are ignored: +If DANE is requested and useable (see above) the following transport +options are ignored: hosts_require_tls tls_verify_hosts tls_try_verify_hosts @@ -1315,6 +1316,10 @@ If dane is in use the following transport options are ignored: tls_crl tls_verify_cert_hostnames +If DANE is not usable, whether requested or not, and CA-anchored +verification evaluation is wanted, the above variables should be set +appropriately. + Currently dnssec_request_domains must be active (need to think about that) and dnssec_require_domains is ignored. |