4 ms·
I would have liked to see the logic on client side to decide if the certificate presented by the server is valid.
by Rygian 2y ago
I would have liked to see the logic on client side to decide if the certificate presented by the server is valid.
- ranger_danger 2y agoThe page was updated to include that.
- Rygian 2y agoWell done!
- Retr0id 2y agoI'm a little surprised the OpenSSL API doesn't force you to consider this by default, but indeed it does not: https://www.openssl.org/docs/manmaster/man3/SSL_CTX_new.html#NOTES https://www.openssl.org/docs/manmaster/man3/SSL_CTX_new.html... > On session establishment, by default, no peer credentials verification is done. This must be explicitly requested, typically using SSL_CTX_set_verify(3). Aside: According to those docs, SSLv23_client_method() is deprecated.
- Severian 2y agoYeah, not verifying server cert or OCSP/CRLs is a problem. DNS attacks can redirect and you'd be none the wiser.