I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to skip ssl verification nor do I want to blindly trust any certificate signed by the backup server's certificate authority (in case the backup server is compromised or whatever).

How can I trust just the backup server's certificate (not potentially other certificates from the same ca) just for doing the rsync backup (not globally for other applications on the same host)? Am I thinking about this incorrectly? What should I do?

  • What transport layer are you running rsync over? Often, rsync is run over SSH. If that's the case, you can let SSH do the heavy lifting as far as authentication is concerned, using SSH public key authentication. Just create a key pair on the client side, and drop the client's public key in the authorized_keys file on the server. That's all there is to it, no CA's needed.
    – mti2935
    Oct 14 '21 at 23:16

If your certificate is self-signed, then you can trust that one specific certificate and none other. It is actually quite a secure setup, but it has the downside of requiring approval of the certificate on every machine that communicates with that server.

If, however, your entire problem just revolves around one server communicating with one other server, then just manually trust the certificate and you will be safe.

For context, SSH works in a similar way. SSH has a Trust On First Use(TOFU) model, where you are simply asked if that key is fine to you and you say yes or no.

  • As a rule, upvote Q, at least they pass 15 points...
    – kelalaka
    Oct 16 '21 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.