Re: [PATCH] config: add http.sslVerifyHost option

Re: [PATCH] config: add http.sslVerifyHost option

[Patrick Steinhardt]

On Fri, Aug 07, 2026 at 04:33:14PM +0100, Ron Nazarov wrote:
> This allows for disabling host verification without completely
> disabling TLS certificate verification.  This is useful when using TLS
> in a decentralized way (similar to how one would use SSH), where the
> remote endpoint has a self-signed certificate that does not
> necessarily have a valid CN (or any CN at all), and you set
> http.sslCAInfo to that specific certificate.  Without such an option,
> it is impossible to use a certificate with a non-matching hostname
> without completely disabling TLS verification, which is insecure.

Arguably both options are insecure, this new option just pretends to be
secure. If we accept arbitrary certificates for an endpoint, then it
becomes trivial for somebody to perform a man-in-the-middle attack
against you by simply swapping out the certificate against a self-signed
one. And man-in-the-middle attacks are basically what we want to protect
against with TLS.

So sure, using no encryption at all might be even simpler for an
eavesdropper to intercept. But in both cases they'd have to sit between
you and the server, and consequently they are very likely to have the
capability to MITM you.

There are of course going to be exception to this, like for example when
you sit on an unsecured wifi network. Other users might be able to read
your traffic there without also having the ability to modify it. But I'm
still hesitant to add this new option here as it oversells the security
benefit it offers over disabling TLS entirely.

Maybe I'm missing something obvious. But if so, I think both the commit
message and the documentation would need to be amended to document that
gap and state that yes, this is still insecure.

Thanks!

Patrick

Re: [PATCH] config: add http.sslVerifyHost option

[brian m. carlson]

[-- Attachment #1: Type: text/plain, Size: 3107 bytes --]

On 2026-08-11 at 12:40:31, Patrick Steinhardt wrote:
> On Fri, Aug 07, 2026 at 04:33:14PM +0100, Ron Nazarov wrote:
> > This allows for disabling host verification without completely
> > disabling TLS certificate verification.  This is useful when using TLS
> > in a decentralized way (similar to how one would use SSH), where the
> > remote endpoint has a self-signed certificate that does not
> > necessarily have a valid CN (or any CN at all), and you set
> > http.sslCAInfo to that specific certificate.  Without such an option,
> > it is impossible to use a certificate with a non-matching hostname
> > without completely disabling TLS verification, which is insecure.
> 
> Arguably both options are insecure, this new option just pretends to be
> secure. If we accept arbitrary certificates for an endpoint, then it
> becomes trivial for somebody to perform a man-in-the-middle attack
> against you by simply swapping out the certificate against a self-signed
> one. And man-in-the-middle attacks are basically what we want to protect
> against with TLS.

I agree.

> So sure, using no encryption at all might be even simpler for an
> eavesdropper to intercept. But in both cases they'd have to sit between
> you and the server, and consequently they are very likely to have the
> capability to MITM you.
> 
> There are of course going to be exception to this, like for example when
> you sit on an unsecured wifi network. Other users might be able to read
> your traffic there without also having the ability to modify it. But I'm
> still hesitant to add this new option here as it oversells the security
> benefit it offers over disabling TLS entirely.

No, on an unsecured Wi-Fi network one can use ARP spoofing to send all
the packets on the network to them before they relay them to others, so
they can all be modified.  I've done this in controlled environments and
while the network can appear slow in some cases if you're just using a
plain laptop, it works.

Some Wi-Fi networks have some sort of isolation feature to try to
prevent this but I've read papers that they're easy to bypass.

The assumption you absolutely must make is that anyone who can see your
packets can also modify them.

> Maybe I'm missing something obvious. But if so, I think both the commit
> message and the documentation would need to be amended to document that
> gap and state that yes, this is still insecure.

I just don't think we should accept this option because it leads to a
false sense of security and it's easy to misuse.  Moreover, getting a
reasonable working TLS configuration is extremely easy with ACME and/or
DANE these days, so there's really no reason to need to accommodate
broken self-signed certificates anymore.

I'll note that technically nobody actually uses CN anymore for
certificate verification (and I think Go's TLS library ignores it
entirely) and everyone uses subjectAltName, so it's possible to provide
a reasonably large number of different names for a single host.
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 325 bytes --]

Re: [PATCH] config: add http.sslVerifyHost option

[Patrick Steinhardt]

On Wed, Aug 12, 2026 at 04:31:59AM +0100, Ron Nazarov wrote:
> On 11/08/2026 13:40, Patrick Steinhardt wrote:
> > On Fri, Aug 07, 2026 at 04:33:14PM +0100, Ron Nazarov wrote:
> > > This allows for disabling host verification without completely
> > > disabling TLS certificate verification.  This is useful when using TLS
> > > in a decentralized way (similar to how one would use SSH), where the
> > > remote endpoint has a self-signed certificate that does not
> > > necessarily have a valid CN (or any CN at all), and you set
> > > http.sslCAInfo to that specific certificate.  Without such an option,
> > > it is impossible to use a certificate with a non-matching hostname
> > > without completely disabling TLS verification, which is insecure.
> > 
> > Arguably both options are insecure, this new option just pretends to be
> > secure. If we accept arbitrary certificates for an endpoint, then it
> > becomes trivial for somebody to perform a man-in-the-middle attack
> > against you by simply swapping out the certificate against a self-signed
> > one. And man-in-the-middle attacks are basically what we want to protect
> > against with TLS.
> > 
> > [...]
> > 
> > Maybe I'm missing something obvious. But if so, I think both the commit
> > message and the documentation would need to be amended to document that
> > gap and state that yes, this is still insecure.
> > 
> 
> The intention is for this to be combined with setting sslCAInfo and/or
> sslCAPath to the specific self-signed certificate used for the remote
> (rather than to something like a public CA where anyone can easily get a
> certificate signed by it).  If used on its own (with the default CA
> certificate store) it is of course insecure.  The commit message already
> states this ("and you set http.sslCAInfo to that specific certificate",
> although perhaps it could be made more clear that if you don't do this it is
> insecure), but the documentation currently does not.  The specific use-case
> I am currently using this option for is a private git server accessible over
> a public IPv6 address using a self-signed certificate which does not have a
> valid CN (or a subjectAltName) at all.  I have something like this in my
> .gitconfig:
> 
> [http "https://[2001:db8::1]/"]
>         sslCAInfo = /path/to/cert.pem
>         sslVerifyHost = false
>         sslCAPath = /dev/null
> 
> where /path/to/cert.pem is the specific certificate served by the git
> server, which I have verified externally to belong to the owner.  This
> provides the same security guarantees as using SSH with the server's
> fingerprint in my known_hosts file.

Okay, that's a whole lot more reasonable then. You essentially pin the
certificate that you expect from the server-side, and as a result noone
can intercept the traffic unless they have the private key. We should
definitely update the documentation then to highlight how users can
securely use `sslVerifyHost` so that they're not on their own to figure
this out.

> (Also, this is unrelated to your review, but for some reason my original
> email containing the patch is missing from lore.kernel.org.  I don't know
> why, since people not in the CC list are replying, it presumably must have
> been sent to the list.)

Hm, curious. No idea why that is -- hopefully, v2 will land just fine.

Patrick