Meinberg SHSPZF LANTIME - Manual (Page 68)

Example:
This autokey group is formed by one Stratum-1-server (B), two Stratum-2-servers (D
and E) and a number of clients (in the diagram there are 4 clients shown, c1 – c4). B
is the trusted host, he holds the group key and a self-signed certificate marked as
“trusted”.
D and E are NTP servers, which are “non-trusted” hosts of the group, they hold the
group key and a self-signed certificate which lacks the “trusted” mark. The clients
also hold the group key and a self-signed certificate.
In order to distribute new public keys to the whole group, the administrator only has
to generate a new “t” key, which will be distributed automatically to the two hosts D
and E. Because these two servers can now present a unbroken chain of certificates to
a trusted host, they can be considered “trusted” by the clients as well.
More about the technical background and detailed processes of the AUTOKEY
technique can be found at the official NTP website (http://www.ntp.org).
68