Re: [PATCH] config: add http.sslVerifyHost option

Re: [PATCH] config: add http.sslVerifyHost option

[Patrick Steinhardt]

On Fri, Aug 07, 2026 at 04:33:14PM +0100, Ron Nazarov wrote:
> This allows for disabling host verification without completely
> disabling TLS certificate verification.  This is useful when using TLS
> in a decentralized way (similar to how one would use SSH), where the
> remote endpoint has a self-signed certificate that does not
> necessarily have a valid CN (or any CN at all), and you set
> http.sslCAInfo to that specific certificate.  Without such an option,
> it is impossible to use a certificate with a non-matching hostname
> without completely disabling TLS verification, which is insecure.

Arguably both options are insecure, this new option just pretends to be
secure. If we accept arbitrary certificates for an endpoint, then it
becomes trivial for somebody to perform a man-in-the-middle attack
against you by simply swapping out the certificate against a self-signed
one. And man-in-the-middle attacks are basically what we want to protect
against with TLS.

So sure, using no encryption at all might be even simpler for an
eavesdropper to intercept. But in both cases they'd have to sit between
you and the server, and consequently they are very likely to have the
capability to MITM you.

There are of course going to be exception to this, like for example when
you sit on an unsecured wifi network. Other users might be able to read
your traffic there without also having the ability to modify it. But I'm
still hesitant to add this new option here as it oversells the security
benefit it offers over disabling TLS entirely.

Maybe I'm missing something obvious. But if so, I think both the commit
message and the documentation would need to be amended to document that
gap and state that yes, this is still insecure.

Thanks!

Patrick

Re: [PATCH] config: add http.sslVerifyHost option

[brian m. carlson]

[-- Attachment #1: Type: text/plain, Size: 3107 bytes --]

On 2026-08-11 at 12:40:31, Patrick Steinhardt wrote:
> On Fri, Aug 07, 2026 at 04:33:14PM +0100, Ron Nazarov wrote:
> > This allows for disabling host verification without completely
> > disabling TLS certificate verification.  This is useful when using TLS
> > in a decentralized way (similar to how one would use SSH), where the
> > remote endpoint has a self-signed certificate that does not
> > necessarily have a valid CN (or any CN at all), and you set
> > http.sslCAInfo to that specific certificate.  Without such an option,
> > it is impossible to use a certificate with a non-matching hostname
> > without completely disabling TLS verification, which is insecure.
> 
> Arguably both options are insecure, this new option just pretends to be
> secure. If we accept arbitrary certificates for an endpoint, then it
> becomes trivial for somebody to perform a man-in-the-middle attack
> against you by simply swapping out the certificate against a self-signed
> one. And man-in-the-middle attacks are basically what we want to protect
> against with TLS.

I agree.

> So sure, using no encryption at all might be even simpler for an
> eavesdropper to intercept. But in both cases they'd have to sit between
> you and the server, and consequently they are very likely to have the
> capability to MITM you.
> 
> There are of course going to be exception to this, like for example when
> you sit on an unsecured wifi network. Other users might be able to read
> your traffic there without also having the ability to modify it. But I'm
> still hesitant to add this new option here as it oversells the security
> benefit it offers over disabling TLS entirely.

No, on an unsecured Wi-Fi network one can use ARP spoofing to send all
the packets on the network to them before they relay them to others, so
they can all be modified.  I've done this in controlled environments and
while the network can appear slow in some cases if you're just using a
plain laptop, it works.

Some Wi-Fi networks have some sort of isolation feature to try to
prevent this but I've read papers that they're easy to bypass.

The assumption you absolutely must make is that anyone who can see your
packets can also modify them.

> Maybe I'm missing something obvious. But if so, I think both the commit
> message and the documentation would need to be amended to document that
> gap and state that yes, this is still insecure.

I just don't think we should accept this option because it leads to a
false sense of security and it's easy to misuse.  Moreover, getting a
reasonable working TLS configuration is extremely easy with ACME and/or
DANE these days, so there's really no reason to need to accommodate
broken self-signed certificates anymore.

I'll note that technically nobody actually uses CN anymore for
certificate verification (and I think Go's TLS library ignores it
entirely) and everyone uses subjectAltName, so it's possible to provide
a reasonably large number of different names for a single host.
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 325 bytes --]