Giorgio Maone: > On 17/11/2015 17:11, sajolida wrote: >> Giorgio Maone: >> Now you've got the flexibility of choosing to pin the domain cert, the >> issuer's (CA's) cert or both. >> I've seen that in conf.json. Regarding the different kinds of pinning, >> how do you switch from trusting the cert to trusting the issuer or both? >> By adding and removing the corresponding information in the >> configuration file? Is it that any pinning available in the >> configuration file is trusted? >> > In the "pins" section, you can add as many "certs" and "issuers" entries > as you want, listing identifiers for domain certificates and their > issuers, respectively. > Whether they're actually used to verify a certain domain or not is > determined by the content of "pins" > "domains", though. > This section currently looks like this: > > "domains": { > "tails.boum.org": { > "cert": null, > "issuer": "Gandi" > }, > "maone.net": { > "cert": "maone.net", > "issuer": "COMODO" > } > } > > For any entry in "domains", you can specify a reference to a "certs" > entry ("cert"), to an "issuers" entry ("issuer") or both. > In the example above, "tails.boum.org" is pinned on its issuer ("Gandi") > only (because "cert" is null, rather than "*.boum.org"), while the > "maone.net" domain is pinned both on the certificated referenced by the > "maone.net" key and to the "COMODO" issuer. > > If I've not been clear enough, feel free to ask.
Cristal clear, thanks. I'm quite tired these days due to tons of work. I didn't pay enough attention to the differences between tails.boum.org and maone.net (like "cert": null). _______________________________________________ Tails-dev mailing list Tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev To unsubscribe from this list, send an empty email to tails-dev-unsubscr...@boum.org.