[gambit-list] No TLS certificate validation

Marc Feeley feeley at iro.umontreal.ca
Wed Nov 15 07:33:33 EST 2017


Clearly something has to be done! I didn’t write that code, so perhaps someone with more experience with OpenSSL should take a look at it.

Marc



> On Nov 15, 2017, at 4:17 AM, Dimitris Vyzovitis <vyzo at hackzen.org> wrote:
> 
> Marc,
> 
> It seems that the TLS stack is completely lacking client-side server
> certificate validation. There are now two open issues on github (#200
> and #312 which I just opened).
> 
> This is a real security problem, as not having certificate validation
> defeats the whole purpose of TLS.
> 
> Can we do something about it?
> 
> -- vyzo
> 




More information about the Gambit-list mailing list