From edbf8846059a9f3e2d5a6bdf8227f97f5d79da4f Mon Sep 17 00:00:00 2001 From: "Antonios Chariton (daknob)" Date: Fri, 5 Apr 2024 22:38:08 +0200 Subject: Fix mistake in RPKI documentation about the use of TLS HTTP is not used for RPKI information, the RTR protocol is used, which works on top of plain TCP. Although some implementations can use TLS, VyOS (and FRR) do not support it, and use either plain TCP or SSH. --- docs/configuration/protocols/rpki.rst | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/configuration/protocols/rpki.rst b/docs/configuration/protocols/rpki.rst index aeb2941b..acce2d56 100644 --- a/docs/configuration/protocols/rpki.rst +++ b/docs/configuration/protocols/rpki.rst @@ -140,11 +140,13 @@ Configuration SSH === -Connections to the RPKI caching server can not only be established by HTTP/TLS -but you can also rely on a secure SSH session to the server. To enable SSH, -first you need to create an SSH client keypair using ``generate ssh -client-key /config/auth/id_rsa_rpki``. Once your key is created you can setup -the connection. +Connections to the RPKI caching server can not only be established by TCP using +the RTR protocol but you can also rely on a secure SSH session to the server. +This provides transport integrity and confidentiality and it is a good idea if +your validation software supports it. To enable SSH, first you need to create +an SSH client keypair using ``generate ssh client-key +/config/auth/id_rsa_rpki``. Once your key is created you can setup the +connection. .. cfgcmd:: set protocols rpki cache
ssh username -- cgit v1.2.3