FreeTDS Development Group

["ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>]

> 
> Correct me if I am wrong, but I believe certificates are a 
> bit like DNS: you
> chain up a tree.  In this case, the server and you should 
> both check each
> other's certificates chain up to a common trusted ancestor 
> like VeriSign or
> your company.  You need a certificate from that trusted ancestor (the
> company domain controller if this is all within one company), 
> so you are
> hanging in the trust tree.  Once 'you' are trusted, you can give out
> certificates to 'others' you 'trust', extending the tree.  
> VeriSign says
> your company certificate server is really '2at.nl', the 
> '2at.nl' certificate
> server says you are really 'wouter', and so on.
> 
> The process can be modeled as registering a certificate or getting a
> certificate, but what matters is that the certificate 
> signatures decode as
> being chained together.
> 

In theory... in practise Microsoft do not check that much connecting to
a mssql server...

> BTW, the certificates are time limited, so trust has to be 
> renewed, which is
> good: stale relationships are not valid forever (and also, I 
> guess VeriSign
> gets paid periodically).
> 
> My browser is always complaining about expired or unhooked 
> certificates.
> 

Well, the main reason is explained in previous paragraph :) A
certificate cost more than a hosting...

freddy77