Re: I-D Action:draft-ietf-radext-dynamic-discovery-00.txt

[Alan DeKok <aland@deployingradius.com>]

Glen Zorn wrote:
> Of course, what was I thinking?  Setting up a CA, issuing client and server
> certs and configuring secure DNS is _so_ much simpler than laboriously
> typing an IP address.  This simplicity must explain the amazing popularity
> (indeed, true ubiquity) of the PKI today.  

  It's done for EAP methods.

  And the choice is up to the operational people.  Doing certs for
client/server authentication is a higher up-front cost than IP/secret.
However, the ongoing maintenance costs can be lower.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>