TigerVNC/tigervnc

X509 client authentication

Open

#787 opened on Jan 14, 2019

View on GitHub
 (8 comments) (0 reactions) (0 assignees)C++ (1,176 forks)github user discovery
enhancementhelp wanted

Repository metrics

Stars
 (7,396 stars)
PR merge metrics
 (Avg merge 95d 10h) (4 merged PRs in 30d)

Description

Is there a technical reason why the X509CA configuration option is available on the client side, but not the server side ? I wanted to use this so that a VNC server would only accept client connections from users with a certificate signed from the configured CA. It is possible to configure OpenVPN and SSH to trust a given CA, so I was wondering why this "trusting feature" was implemented the other way around in TigerVNC.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Contributor guide

Research direction
Examine the existing X509CA implementation on the client side, understand the server's current certificate handling, and design a server side X509CA option to trust client certificates signed by a specific CA.
Tech stack
cpp
Domain
authentication
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
TLS/SSLX.509 certificates
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40