From 888e0c88a9c151abe791dd0adcc533167c7136ac Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Wed, 3 Mar 2021 11:38:47 -0500 Subject: [PATCH] Slight website wordsmithing --- .../content/docs/concepts/security/connections-tls.mdx | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/website/content/docs/concepts/security/connections-tls.mdx b/website/content/docs/concepts/security/connections-tls.mdx index 01aefd0c4..89de4f991 100644 --- a/website/content/docs/concepts/security/connections-tls.mdx +++ b/website/content/docs/concepts/security/connections-tls.mdx @@ -84,11 +84,11 @@ TLS establishment is performed as follows: 1. When the session is authorized, the Controller generates a TLS certificate acting as a self-contained chain. This is similar to the Worker-to-Controller - flow above, but in this case the key is an Ed25519 key generated via derivation - from a base key within the Controller, which itself is protected at rest via the - controller's "root" KMS. The derivation uses HKDF-SHA256 with the user ID and - the session ID as inputs. The lifetime of the certificate is tied to the - lifetime of the session. + flow above, but in this case the key is an Ed25519 key generated via + derivation from a base key within the Controller, which itself is protected + at rest via the "root" KMS for the scope that contains the target. The + derivation uses HKDF-SHA256 with the user ID and the session ID as inputs. + The lifetime of the certificate is tied to the lifetime of the session. 2. The certificate and private key (along with other session authorization data, notably the session ID) are returned to the client as part of the output of an