diff options
| author | Antonios Chariton (daknob) <daknob.mac@gmail.com> | 2024-04-05 22:38:08 +0200 |
|---|---|---|
| committer | Antonios Chariton (daknob) <daknob.mac@gmail.com> | 2024-04-05 22:38:08 +0200 |
| commit | edbf8846059a9f3e2d5a6bdf8227f97f5d79da4f (patch) | |
| tree | 25ed7fdab593663df7580e163b9d51f93bffb65f | |
| parent | 7bee765d6a920f99047bfb99e4679080ea85f976 (diff) | |
| download | vyos-documentation-edbf8846059a9f3e2d5a6bdf8227f97f5d79da4f.tar.gz vyos-documentation-edbf8846059a9f3e2d5a6bdf8227f97f5d79da4f.zip | |
Fix mistake in RPKI documentation about the use of TLS
HTTP is not used for RPKI information, the RTR protocol is used, which works on
top of plain TCP. Although some implementations can use TLS, VyOS (and FRR) do
not support it, and use either plain TCP or SSH.
| -rw-r--r-- | docs/configuration/protocols/rpki.rst | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/docs/configuration/protocols/rpki.rst b/docs/configuration/protocols/rpki.rst index aeb2941b..acce2d56 100644 --- a/docs/configuration/protocols/rpki.rst +++ b/docs/configuration/protocols/rpki.rst @@ -140,11 +140,13 @@ Configuration SSH === -Connections to the RPKI caching server can not only be established by HTTP/TLS -but you can also rely on a secure SSH session to the server. To enable SSH, -first you need to create an SSH client keypair using ``generate ssh -client-key /config/auth/id_rsa_rpki``. Once your key is created you can setup -the connection. +Connections to the RPKI caching server can not only be established by TCP using +the RTR protocol but you can also rely on a secure SSH session to the server. +This provides transport integrity and confidentiality and it is a good idea if +your validation software supports it. To enable SSH, first you need to create +an SSH client keypair using ``generate ssh client-key +/config/auth/id_rsa_rpki``. Once your key is created you can setup the +connection. .. cfgcmd:: set protocols rpki cache <address> ssh username <user> |