| Re: 答复: 答复: [chrony-users] ipV4 and ipV6 |
[ Thread Index |
Date Index
| More chrony.tuxfamily.org/chrony-users Archives
]
- To: chrony-users@xxxxxxxxxxxxxxxxxxxx
- Subject: Re: 答复: 答复: [chrony-users] ipV4 and ipV6
- From: Miroslav Lichvar <mlichvar@xxxxxxxxxx>
- Date: Wed, 30 Nov 2022 10:25:41 +0100
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1669800348; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=rfHJVeHZ0PJ0jY66XRYKSluOhG7Im7pw0ewlwVKfTSI=; b=QI7VVC3fQ6X8Udt+qm7Go+VP/oQcZ6RQ5uIihcyH9hGkldF0tbCMmNdffO+9UYSI10kAcm BQ/bjn243cyG0fNd9Ir2tSwsI3t/d4CzXJskw+9RuSiqyLkP9i+i/ZqNHdbKwVmdDEbs6x 8qzByRhPIn388XXmlC6TwWt5FPUoPDY=
On Wed, Nov 30, 2022 at 08:44:35AM +0000, chengyechun wrote:
> Do the certificates contain a different name? If there are multiple certificates with the same name, the server will provide only one the clients.
> Different IP addresses
I'm not sure if that is supposed to work. The NTS-KE client
doesn't provide the IP address to the server (at least the
gnutls_server_name_set() function doesn't allow that), and gnutls as a
TLS server probably doesn't check the address of the socket in
expectation that there will be a matching address in one of the
certificates. Maybe an RFE could be submitted for that.
> This is because one client uses IPv6 to communicate with the server, while the other uses IPv4. This is because ip_address is used to generate a certificate. The template is as follows:
>
> organization = "xiaoyu"
> country = CN
> ip_address = "11.11.7.120"
> serial = 001
> activation_date = "2022-01-01 00:00:00 UTC"
> expiration_date = "2022-12-31 23:59:59 UTC"
> signing_key
> encryption_key
>
>
> The IPv6 template is to modify ip_address. Can this be unified?--
Yes, you can specify multiple addresses in the certificate. Just add
more lines with "ip_address = ...". No need to use separate
certificates.
--
Miroslav Lichvar
--
To unsubscribe email chrony-users-request@xxxxxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject.
For help email chrony-users-request@xxxxxxxxxxxxxxxxxxxx
with "help" in the subject.
Trouble? Email listmaster@xxxxxxxxxxxxxxxxxxxx.