MSGID: 2:280/464.47 5eb3e42c   
   REPLY: 2:5030/1997@fidonet 5eb34264   
   PID: JamNNTPd/Linux 1   
   CHRS: LATIN-1 2   
   TZUTC: 0200   
   TID: CrashMail II/Linux 1.7   
   Alexey wrote (2020-05-07):   
      
    AI>> If my current certificate is not good enough then what would be and   
    AI>> why?   
      
    AF> You are using certificate issued by a trusted CA that matches your domain   
    AF> specified in nodelist, which is fine. If there would be a standard for   
    AF> binkps requiring INA to be present and contain a valid domain name, then   
    AF> mailers could verify certificates based on domain names and trusted CA,   
    AF> as web browsers do. But without a standard there is no security. If there   
    AF> will be an IP address in the INA field, how can you verify certificate   
    AF> validity?   
      
   and with FTS-5004 (binkp.net) it's also not really secure. we don't even have   
   an informal agreement how to deal with these addresses does the binkp server   
   have to offer a cert for it's binkp.net address? or should the binkp client   
   verify the certificate based on the domain the CNAME / SRV record points to?   
      
   of course it always can be treat like a self-signed cert.   
      
   ---   
    * Origin:  (2:280/464.47)   
   SEEN-BY: 1/123 90/1 103/705 120/340 601 154/10 203/0 221/0 226/30   
   SEEN-BY: 227/114 702 229/101 200 426 664 1014 240/2100 5138 5832 5853   
   SEEN-BY: 240/6309 249/109 307 317 280/464 5003 5555 288/100 292/854   
   SEEN-BY: 292/8125 310/31 320/219 342/200 396/45 423/120 712/848 770/1   
   SEEN-BY: 2432/390 2452/250 2454/119   
   PATH: 280/464 240/5832 229/426