nic1902
The Security Overview from the documentation page does a good job of explaining how encryption keys are generated and used when both the server and the client have a certificate. Clearly using a PKI is preferable but I find myself in a situation where distributing several hundred certificates is impractical.
Thus far I have been unable to find documentation that describes how the encryption keys are generated and exchanged when client certificates are not used. Some of the documentation I've found implies that using when only using a server certificate the same keys are used for all the tunnels - suggesting the connection is susceptible to eavesdropping.
Does anyone have a pointer to documentation or an explanation of how the key exchange is handled, or more generally what weaknesses are introduced, when client certificates are not used.
thanks
Nic.
