Re:CockroachDB Skitters into Beta
by e12e on Thursday March 31, 2016 @07:08AM
(#11396268)
On a tangential note, I used to think the openssh developers was a little crazy for not using a (a subset of) x509 certs, but now, seeing how ssh is a part of go, I'm not sure if using ssh certs[1] for things like intra-server auth/authz might not be a good idea.
TLS is ok if you need to secure something that speaks HTTP (or IMAP etc) -- but I wonder if ssh certs might not be the lesser evil for something like what cockroachdb needs. Perhaps esepcially now as self-signed/"home grown" x509 certs are being relegated to the background by modern browsers -- so you'd end up needing a "real" cert for the status-server to present securely to a web-client, which might not match the wish for every node to have its own keypair.
TLS is ok if you need to secure something that speaks HTTP (or IMAP etc) -- but I wonder if ssh certs might not be the lesser evil for something like what cockroachdb needs. Perhaps esepcially now as self-signed/"home grown" x509 certs are being relegated to the background by modern browsers -- so you'd end up needing a "real" cert for the status-server to present securely to a web-client, which might not match the wish for every node to have its own keypair.
[1] https://godoc.org/golang.org/x/crypto/ssh#Certificate