From 9fe4b8a9360c8c6544a21111c556cd0a4ec30d6c Mon Sep 17 00:00:00 2001 From: "Antonios Chariton (daknob)" Date: Fri, 5 Apr 2024 22:38:08 +0200 Subject: Fix mistake in RPKI documentation about the use of TLS HTTP is not used for RPKI information, the RTR protocol is used, which works on top of plain TCP. Although some implementations can use TLS, VyOS (and FRR) do not support it, and use either plain TCP or SSH. (cherry picked from commit edbf8846059a9f3e2d5a6bdf8227f97f5d79da4f) --- docs/configuration/protocols/rpki.rst | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'docs/configuration') diff --git a/docs/configuration/protocols/rpki.rst b/docs/configuration/protocols/rpki.rst index d40bfb5c..acce2d56 100644 --- a/docs/configuration/protocols/rpki.rst +++ b/docs/configuration/protocols/rpki.rst @@ -140,11 +140,13 @@ Configuration SSH === -Connections to the RPKI caching server can not only be established by HTTP/TLS -but you can also rely on a secure SSH session to the server. To enable SSH you -first need to create yoursels an SSH client keypair using ``generate ssh -client-key /config/auth/id_rsa_rpki``. Once your key is created you can setup -the connection. +Connections to the RPKI caching server can not only be established by TCP using +the RTR protocol but you can also rely on a secure SSH session to the server. +This provides transport integrity and confidentiality and it is a good idea if +your validation software supports it. To enable SSH, first you need to create +an SSH client keypair using ``generate ssh client-key +/config/auth/id_rsa_rpki``. Once your key is created you can setup the +connection. .. cfgcmd:: set protocols rpki cache
ssh username -- cgit v1.2.3