Re: [chrony-users] NTS: Limiting

[Kurt Roeckx <kurt@xxxxxxxxx>]

On Wed, Jan 20, 2021 at 10:15:17AM +0100, Miroslav Lichvar wrote:
> On Wed, Jan 20, 2021 at 10:03:57AM +0100, Karol Babioch wrote:
> > When I have something like this in my chrony.conf:
> > 
> > > pool pool.example.com iburst maxsources 3
> > 
> > Is NTS even possible in such a context? AFAIK only A records with IP
> > addresses are resolved, so I'm not sure if and how certificates can be
> > validated.
> 
> Yes, NTS can work with pools. The servers need to have the same name
> in their certificates, one that matches the name specified in the
> chrony config.
> 
> I have a small pool of servers running under the name
> "nts-test.strangled.net".

I think what you're saying is that even when it there are multiple
A records for it, they all have a certificate for
nts-test.strangled.net.


Kurt


-- 
To unsubscribe email chrony-users-request@xxxxxxxxxxxxxxxxxxxx 
with "unsubscribe" in the subject.
For help email chrony-users-request@xxxxxxxxxxxxxxxxxxxx 
with "help" in the subject.
Trouble?  Email listmaster@xxxxxxxxxxxxxxxxxxxx.