Scannex ip.buffer User Manual
© UK 2007-2021 Scannex Electronics Ltd. All rights reserved worldwide.
8.2.10. Certificates for SSL/TLS and SSH
The certificates
section allows options to “lock” the ip.buffer to specific servers by
checking the servers' certificates. Additionally, clients can be forced to provide a client
certificate for checking against a list of approved fingerprints.
The fingerprints are a mathematical “hash” of the full certificate. There are two common
methods of hashing certificates - “MD5” and “SHA1”. The ip.buffer uses the stronger SHA1
fingerprint hash method. The full certificates can be very large (several kilo-bytes),
whereas an SHA1 hash is 20bytes long. In the ip.buffer it is shown as 20 pairs of hex
numbers.
e.g. “0c:15:fe:6e:7f:b4:cd:2c:64:18:16:8b:d5:3a:67:6e:c7:54:b8:71”
Locking an ip.buffer to a particular server certificate will prevent “man-in-the-middle”
style attacks and spoofing. The ip.buffer will only connect to the genuine server.
39
SSL/TLS firmware only.
Page 44
Scannex ip.buffer User Manual
© UK 2007-2021 Scannex Electronics Ltd. All rights reserved worldwide.
8.2.10. Certificates for SSL/TLS and SSH
The certificates
section allows options to “lock” the ip.buffer to specific servers by
checking the servers' certificates. Additionally, clients can be forced to provide a client
certificate for checking against a list of approved fingerprints.
The fingerprints are a mathematical “hash” of the full certificate. There are two common
methods of hashing certificates - “MD5” and “SHA1”. The ip.buffer uses the stronger SHA1
fingerprint hash method. The full certificates can be very large (several kilo-bytes),
whereas an SHA1 hash is 20bytes long. In the ip.buffer it is shown as 20 pairs of hex
numbers.
e.g. “0c:15:fe:6e:7f:b4:cd:2c:64:18:16:8b:d5:3a:67:6e:c7:54:b8:71”
Locking an ip.buffer to a particular server certificate will prevent “man-in-the-middle”
style attacks and spoofing. The ip.buffer will only connect to the genuine server.
39
SSL/TLS firmware only.
Page 44
