akbsol Hi all, When we use only auth-user-pass-verify to authenticate connections and client config doesn't have any certs expect a <ca> and <tls-auth> section, are the options such as: remote-cert-tls server & tls-remote still needed? From my understanding, as the client doesn't have any common CA signed certificate & key of his own, he has no way to impersonate as the server? Please correct me if I am wrong. Thanks.
TinCanTech akbsol wrotePlease suggestSuggest: Most people prefer more security than less .. MITM attacks are carried out by a Man-In-The-Middle .. not your client or server.
akbsol Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.
