[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Change over to anonymous binds



man, 2002-08-19 kl. 00:25 skrev Kurt D. Zeilenga:

> Choosing the name to put in the CN of your server cert
> should be simple.  Choose the fully qualified domain name
> which will return for the client the desired IP address(es)
> of the server and place the certificate.  If there are
> multiple FQDNs, choose the one which you would like the
> users to enter.

Though ... as I wrote, that's o.k. if your host is constantly connected
to the network bearing/served by that domain name. Mine isn't.

This machine is a dialup node with a static IP number (212.238.97.135)
for which I and my ISP have chosen the name billy.demon.nl. My name
server cannot possibly be authorative for demon.nl.

So if I put billy.demon.nl in my certificate, it constantly wants to go
to the Internet to resolve it.

My workaround was to make certificates with non-qualified cn=localhost
and configure the caching nameserver on the node to be authorative for
localhost.demon.nl - 127.0.0.1 - which is the answer it would get from
Demon's nameservers anyway (I used to be DNS admin for my firms, with up
to 4 Internet nameservers, for which the zone tables first had to be
approved by the Dutch Internet authority).

Or perhaps someone has a better suggestion? Mine works fine for me :-)

Best,

Tony
 
-- 

Tony Earnshaw

The usefulness of RTFM is vastly overrated.

e-post:		tonni@billy.demon.nl
www:		http://www.billy.demon.nl
gpg public key:	http://www.billy.demon.nl/tonni.armor

Telefoon:	(+31) (0)172 530428
Mobiel:		(+31) (0)6 51153356

GPG Fingerprint = 3924 6BF8 A755 DE1A 4AD6 FA2B F7D7 6051 3BE7 B981
3BE7B981