shithub: riscv

ref: 1b7e120c090af2f8f0e17a664ba0e5e5d7f261a0
dir: /sys/man/6/thumbprint/

View raw version
.TH THUMBPRINT 6
.SH NAME
thumbprint \- public key thumbprints
.SH DESCRIPTION
.PP
Applications in Plan 9 that use public keys for authentication,
for example by calling
.B tlsClient
and
.B okThumbprint
(see
.IR pushtls (2)),
check the remote side's public key by comparing against
thumbprints from a trusted list.
The list is maintained by people who set local policies
about which servers can be trusted for which applications,
thereby playing the role taken by certificate authorities
in PKI-based systems.
By convention, these lists are stored as files in
.B /sys/lib/tls/
and protected by normal file system permissions.
.PP
Such a thumbprint file comprises lines made up of
attribute/value pairs of the form
.IB attr = value
or
.IR attr .
The first attribute must be
.B x509
and the second must be
.BI sha1= {hex checksum of binary certificate}.
All other attributes are treated as comments.
The file may also contain lines of the form
.BI #include file
.PP
For example, a web server might have thumbprint
.EX
x509 sha1=8fe472d31b360a8303cd29f92bd734813cbd923c cn=*.cs.bell-labs.com
.EE
.SH "SEE ALSO"
.IR pushtls (2)