[chrony-users] NTS with IP addresses

[Sad Clouds <cryintothebluesky@xxxxxxxxx>]

Hi, I'm using chrony with NTS enabled NTP server. If I try to use IP
address, instead of DNS name, I get the following errors:

TLS handshake with 162.159.200.1:4460 (162.159.200.1) failed : Error
in the certificate verification. The certificate is NOT trusted. The
name in the certificate does not match the expected.

Is there a way to tell chrony to use a specific DNS name during
certificate verification? I can't always use DNS at this stage, since
the machine has no RTC clock and DNSSEC will not function until NTP
client sets up correct system time.

One workaround would be to add a line to /etc/hosts, but this is not
ideal, since something like time.cloudflare.com resolves to multiple
IP addresses and I would like chrony to use multiple clock sources. So
I added static entries to local-data in unbound.conf, but this is a
bit overkill and I would rather chrony handle SSL verification on its
own.

Thanks.

-- 
To unsubscribe email chrony-users-request@xxxxxxxxxxxxxxxxxxxx 
with "unsubscribe" in the subject.
For help email chrony-users-request@xxxxxxxxxxxxxxxxxxxx 
with "help" in the subject.
Trouble?  Email listmaster@xxxxxxxxxxxxxxxxxxxx.