Expand description
Deciding which server is the boat’s.
§Why not the public certificate authorities
A boat’s server has no public name and no route to a public authority:
it answers to something.local on a network with no internet behind it,
so nothing like Let’s Encrypt can ever vouch for it. The usual reflex is
a self-signed certificate plus a client that accepts any certificate,
and that combination is worse than it looks. It encrypts, so it feels
safe, but it authenticates nothing: a client that accepts anything
cannot tell the boat’s server from whatever else answers on that
address, and the first thing it does after connecting is hand over a
bearer token good for a year.
So the boat runs an authority of its own instead. One key, kept ashore, signs the server’s certificate; every device that should trust the boat carries the authority’s certificate – public, harmless to copy. A device then knows it is talking to this boat before it sends anything, and adding a device means installing one file rather than weakening a check.
§Why the public roots are left out entirely
Trust::boat_ca builds a store containing the boat’s authority and
nothing else. Keeping the public roots alongside it would mean any of
several hundred authorities could also vouch for a server here, which is
a much larger surface than the one thing this is trying to establish.
§Plain text is a decision, not a default
Trust::plaintext exists for a server that has no TLS at all, which
is still the common case in the Signal K world. It carries an empty
store rather than a permissive one: point it at a wss:// URL and the
handshake fails, loudly, instead of quietly accepting a stranger.
Structs§
- Trust
- Which servers this client is willing to believe.