7x31/mailcow-dockerized
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[WebAuthn] disable rootCA default

Browse Source
This commit is contained in:
FreddleSpl0it
2022-01-19 21:35:21 +01:00
parent 5858c464d9
commit 7df2bb28f8
4 changed files with 12 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
generate_config.sh
View File

@@ -344,22 +344,10 @@ DOVECOT_MASTER_PASS=
# https://mailcow.github.io/mailcow-dockerized-docs/debug-reset_tls/
ACME_CONTACT=
# Disable including device root ca's for WebAuthn
# setting WEBAUTHN_DISABLE_ROOTCA=y will allow you to use Fido2 devices from untrusted Manufacturers
# It will solve "Error: invalid root certificate" at TFA device registration
# Suported devices are
# solo certified
# apple certified
# nitro certified
# yubico certified
# hypersecu certified
# globalSign certified
# googleHardware certified
# microsoftTpmCollection certified
# huawei certified
# trustkey certified
# bsi certified
WEBAUTHN_DISABLE_ROOTCA=n
# Enable webauthn device manufacturer verification
# After setting WEBAUTHN_RESPECT_ROOTCA=y only devices from trusted manufacturers are allowed
# root certificates can be placed for validation under mailcow-dockerized/data/web/inc/lib/WebAuthn/rootCertificates
WEBAUTHN_RESPECT_ROOTCA=n
EOF