Clearly something has to be done! I didn’t write that code, so perhaps someone with more experience with OpenSSL should take a look at it.
Marc
On Nov 15, 2017, at 4:17 AM, Dimitris Vyzovitis vyzo@hackzen.org wrote:
Marc,
It seems that the TLS stack is completely lacking client-side server certificate validation. There are now two open issues on github (#200 and #312 which I just opened).
This is a real security problem, as not having certificate validation defeats the whole purpose of TLS.
Can we do something about it?
-- vyzo