<div dir="ltr">Hi Wilma,<div><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Mar 7, 2014 at 7:40 PM, Wilma Hermann <span dir="ltr"><<a href="mailto:wilma.hermann@gmail.com" target="_blank">wilma.hermann@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Valentin,<br>
<div class=""><br>
> Last time I checked, my CA looked pretty real to me<br>
</div>Admittedly, "real" might have been the wrong word. Probably "common"<br>
would have better described what I meant.<br>
<div class=""><br>
> And why is that? Is Verisign's random number generator better than yours?<br>
</div>No, but their root certificate is shipped with every common browser<br>
out there, even on mobile devices.<br></blockquote><div><br></div><div>You are right. And so we put our trust in them. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class=""><br>
> None of the RFCs I've read about PKI don't tell me that I SHOULD NOT use<br>
> self signed certs for production environments.<br>
</div>Fair enough, that's true. And when you have an environment where you<br>
can ensure that all users have your root certificate installed, then<br>
there's no downside of a private CA-infrastructure. But from ML's<br>
comments I assumed that this particular OpenNebula installation is to<br>
be opened to the public (or at least an audience where ML cannot make<br>
sure that the root certificate is trusted by default).<br>
If that assumption holds and you're not willing to spend a few dollars<br>
for an uninterrupted user-experience, then I question your business<br>
model...<br></blockquote><div><br></div><div>I totally agree with you about the user experience and for it is worth investing</div><div>a few dollars. I guess I am just frustrated that TLS fails to provide peer to peer</div>
<div>trust.</div><div> </div><div><br></div><div>Greetings,</div><div>Valentin</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Greetings<br>
Wilma<br>
<br>
<br>
2014-03-07 17:37 GMT+01:00 Valentin Bud <<a href="mailto:valentin.bud@gmail.com">valentin.bud@gmail.com</a>>:<br>
<div class="HOEnZb"><div class="h5">><br>
> Hello Wilma,<br>
><br>
> On Thu, Feb 6, 2014 at 6:20 PM, Wilma Hermann <<a href="mailto:wilma.hermann@gmail.com">wilma.hermann@gmail.com</a>> wrote:<br>
>><br>
>> There is a really easy fix for that: Get a real certificate from a real CA. You should not use self-signed certs for a production environment.<br>
><br>
><br>
> And why is that? Is Verisign's random number generator better than yours?<br>
> A real certificate from a real CA? I don't get that. Last time I checked, my CA<br>
> looked pretty real to me, conforming with RFC 5280. And the certificates from the<br>
> browser and VPNs issued by that CA are also real.<br>
><br>
> None of the RFCs I've read about PKI don't tell me that I SHOULD NOT use<br>
> self signed certs for production environments.<br>
><br>
> Your business's image could suffer from a self signed cert but that's another<br>
> story. Technology is technology and it should work either way, be it self signed<br>
> or not.<br>
><br>
> Best,<br>
> Valentin<br>
><br>
>><br>
>> Greetings<br>
>> Wilma<br>
>><br>
>><br>
>> 2014-02-06 ML mail <<a href="mailto:mlnospam@yahoo.com">mlnospam@yahoo.com</a>>:<br>
>><br>
>>> This workaround fixes that problem yes but it is not a good workaround especially if you want to offer opennebula to real customers. I hope another better alternative can be found in the future but I am aware that this is mostly a browser problem :|<br>
>>><br>
>>> Regards<br>
>>> ML<br>
>>><br>
>>><br>
>>><br>
>>> On Thursday, February 6, 2014 10:56 AM, Daniel Molina <<a href="mailto:dmolina@opennebula.org">dmolina@opennebula.org</a>> wrote:<br>
>>> Hi,<br>
>>><br>
>>><br>
>>> On 5 February 2014 16:58, ML mail <<a href="mailto:mlnospam@yahoo.com">mlnospam@yahoo.com</a>> wrote:<br>
>>><br>
>>> Hello,<br>
>>><br>
>>> I would like to use noVNC in Sunstone over an encrypted channel (WSS). Therefore I have generated my own SSL key and certificate which I have added to the sunstone-server.conf configuration. The problem is that this does not work, when I start VNC from the Sunstone web interface I get the following error message in novnc.log:<br>
>>><br>
>>> SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca<br>
>>><br>
>>> Does this mean I need an official SSL certificate?<br>
>>><br>
>>><br>
>>> Please, check if the solution proposed in this thread, fixes your problem<br>
>>> <a href="http://lists.opennebula.org/pipermail/users-opennebula.org/2014-February/026405.html" target="_blank">http://lists.opennebula.org/pipermail/users-opennebula.org/2014-February/026405.html</a><br>
>>><br>
>>> Cheers<br>
>>><br>
>>><br>
>>><br>
>>> Regards<br>
>>><br>
>>> ML<br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> Users mailing list<br>
>>> <a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
>>> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
>>><br>
>>><br>
>>><br>
>>><br>
>>> --<br>
>>> --<br>
>>> Daniel Molina<br>
>>> Project Engineer<br>
>>> OpenNebula - Flexible Enterprise Cloud Made Simple<br>
>>> <a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:dmolina@opennebula.org">dmolina@opennebula.org</a> | @OpenNebula<br>
>>><br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> Users mailing list<br>
>>> <a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
>>> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
>>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> Users mailing list<br>
>> <a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
>> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
>><br>
><br>
><br>
><br>
> --<br>
> Valentin Bud<br>
> <a href="http://databus.pro" target="_blank">http://databus.pro</a> | <a href="mailto:valentin@databus.pro">valentin@databus.pro</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Valentin Bud<div><a href="http://databus.pro" target="_blank">http://databus.pro</a> | <a href="mailto:valentin@databus.pro" target="_blank">valentin@databus.pro</a></div>
</div>
</div></div>