Project

General

Profile

Actions

Bug #14848

closed

Net/HTTP doesn't take verify_callback into account when OpenSSL::SSL::VERIFY_NONE

Added by aeris (Nicolas Vinot) almost 6 years ago. Updated almost 5 years ago.

Status:
Rejected
Assignee:
-
Target version:
-
ruby -v:
ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-linux]
[ruby-core:87499]

Description

Hi,

In (at least) net/http, the TLS connection is OK even if verify_callback return false if verify_mode is set to OpenSSL::SSL::VERIFY_NONE.
The callback is really called, but the TLS handshake is not stopped.

Use case: self-signed certificate (so imply VERIFY_NONE) but direct key pinning for trust (implying verify_callback).

Enclosed to this ticket, a example to reproduce the trouble.
For me, because of verify_callback returning false in all case, none of the connection must succeed.


Files

verify_callback.rb (394 Bytes) verify_callback.rb aeris (Nicolas Vinot), 06/15/2018 10:00 AM
Actions

Also available in: Atom PDF

Like0
Like0Like0