[gambit-list] No TLS certificate validation

Dimitris Vyzovitis vyzo at hackzen.org
Wed Nov 15 12:09:17 EST 2017


Seems that it's a matter of using SSL_CTX_set_verify on the tls context,
with SSL_VERIFY_PEER.
See https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_verify(3)

-- vyzo

On Wed, Nov 15, 2017 at 2:33 PM, Marc Feeley <feeley at iro.umontreal.ca>
wrote:

> Clearly something has to be done! I didn’t write that code, so perhaps
> someone with more experience with OpenSSL should take a look at it.
>
> Marc
>
>
>
> > On Nov 15, 2017, at 4:17 AM, Dimitris Vyzovitis <vyzo at hackzen.org>
> wrote:
> >
> > Marc,
> >
> > It seems that the TLS stack is completely lacking client-side server
> > certificate validation. There are now two open issues on github (#200
> > and #312 which I just opened).
> >
> > This is a real security problem, as not having certificate validation
> > defeats the whole purpose of TLS.
> >
> > Can we do something about it?
> >
> > -- vyzo
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.iro.umontreal.ca/pipermail/gambit-list/attachments/20171115/81076242/attachment.htm>


More information about the Gambit-list mailing list