|
|
On Tue, 6 Mar 2007 12:25:03 +0100 Michael wrote: > If they indeed already have that, then I don't see the logic behind > statements like 'ns-cert-type and/or tls-remote can protect against > an MITM attack'. I believe the idea is to enable the VPN administrator to create more than one OpenVPN server (e.g. in a failover setup) with dissimilar names. tls-remote will only accept a single label and will use it as a substring match against the CN provided in the certificate. -- Denis Jedig syneticon networks GbR http://syneticon.net/service/ ______________________ OpenVPN mailing lists https://lists.sourceforge.net/lists/listinfo/openvpn-users |