{"action":"created","issue":{"url":"https://api.github.com/repos/Azure/azure-iot-sdks/issues/826","repository_url":"https://api.github.com/repos/Azure/azure-iot-sdks","labels_url":"https://api.github.com/repos/Azure/azure-iot-sdks/issues/826/labels{/name}","comments_url":"https://api.github.com/repos/Azure/azure-iot-sdks/issues/826/comments","events_url":"https://api.github.com/repos/Azure/azure-iot-sdks/issues/826/events","html_url":"https://github.com/Azure/azure-iot-sdks/issues/826","id":177559393,"number":826,"title":"How to disable certificate validation in C library? ","user":{"login":"rajvael","id":15153467,"avatar_url":"https://avatars.githubusercontent.com/u/15153467?v=3","gravatar_id":"","url":"https://api.github.com/users/rajvael","html_url":"https://github.com/rajvael","followers_url":"https://api.github.com/users/rajvael/followers","following_url":"https://api.github.com/users/rajvael/following{/other_user}","gists_url":"https://api.github.com/users/rajvael/gists{/gist_id}","starred_url":"https://api.github.com/users/rajvael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rajvael/subscriptions","organizations_url":"https://api.github.com/users/rajvael/orgs","repos_url":"https://api.github.com/users/rajvael/repos","events_url":"https://api.github.com/users/rajvael/events{/privacy}","received_events_url":"https://api.github.com/users/rajvael/received_events","type":"User","site_admin":false},"labels":[{"id":356336017,"url":"https://api.github.com/repos/Azure/azure-iot-sdks/labels/CSS","name":"CSS","color":"e99695","default":false},{"id":255806175,"url":"https://api.github.com/repos/Azure/azure-iot-sdks/labels/help%20wanted","name":"help wanted","color":"159818","default":true}],"state":"closed","locked":false,"assignee":{"login":"tameraw","id":9868777,"avatar_url":"https://avatars.githubusercontent.com/u/9868777?v=3","gravatar_id":"","url":"https://api.github.com/users/tameraw","html_url":"https://github.com/tameraw","followers_url":"https://api.github.com/users/tameraw/followers","following_url":"https://api.github.com/users/tameraw/following{/other_user}","gists_url":"https://api.github.com/users/tameraw/gists{/gist_id}","starred_url":"https://api.github.com/users/tameraw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tameraw/subscriptions","organizations_url":"https://api.github.com/users/tameraw/orgs","repos_url":"https://api.github.com/users/tameraw/repos","events_url":"https://api.github.com/users/tameraw/events{/privacy}","received_events_url":"https://api.github.com/users/tameraw/received_events","type":"User","site_admin":false},"assignees":[{"login":"tameraw","id":9868777,"avatar_url":"https://avatars.githubusercontent.com/u/9868777?v=3","gravatar_id":"","url":"https://api.github.com/users/tameraw","html_url":"https://github.com/tameraw","followers_url":"https://api.github.com/users/tameraw/followers","following_url":"https://api.github.com/users/tameraw/following{/other_user}","gists_url":"https://api.github.com/users/tameraw/gists{/gist_id}","starred_url":"https://api.github.com/users/tameraw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tameraw/subscriptions","organizations_url":"https://api.github.com/users/tameraw/orgs","repos_url":"https://api.github.com/users/tameraw/repos","events_url":"https://api.github.com/users/tameraw/events{/privacy}","received_events_url":"https://api.github.com/users/tameraw/received_events","type":"User","site_admin":false}],"milestone":null,"comments":11,"created_at":"2016-09-17T06:23:51Z","updated_at":"2016-11-02T03:51:30Z","closed_at":"2016-10-17T17:42:39Z","body":"Hello,\n        Please suggest me how can I disable certificate validation? We need a custom certificate validation so we want to disable default certificate validation because we want to exclude start and end date certificate validations. It will be great if someone suggest me any switch or flags available to disable. If there is no switch, please suggest me the file that do the certificate validation in C library. \n"},"comment":{"url":"https://api.github.com/repos/Azure/azure-iot-sdks/issues/comments/257765226","html_url":"https://github.com/Azure/azure-iot-sdks/issues/826#issuecomment-257765226","issue_url":"https://api.github.com/repos/Azure/azure-iot-sdks/issues/826","id":257765226,"user":{"login":"dcristoloveanu","id":8507399,"avatar_url":"https://avatars.githubusercontent.com/u/8507399?v=3","gravatar_id":"","url":"https://api.github.com/users/dcristoloveanu","html_url":"https://github.com/dcristoloveanu","followers_url":"https://api.github.com/users/dcristoloveanu/followers","following_url":"https://api.github.com/users/dcristoloveanu/following{/other_user}","gists_url":"https://api.github.com/users/dcristoloveanu/gists{/gist_id}","starred_url":"https://api.github.com/users/dcristoloveanu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcristoloveanu/subscriptions","organizations_url":"https://api.github.com/users/dcristoloveanu/orgs","repos_url":"https://api.github.com/users/dcristoloveanu/repos","events_url":"https://api.github.com/users/dcristoloveanu/events{/privacy}","received_events_url":"https://api.github.com/users/dcristoloveanu/received_events","type":"User","site_admin":false},"created_at":"2016-11-02T03:51:30Z","updated_at":"2016-11-02T03:51:30Z","body":"@rajvael \r\n\r\nWe definitely DON'T recommend disabling certificate validation like Olivier mentioned.\r\nHere is how you should be able do it anyways if needed for development or if you know exactly what your case is.\r\n\r\nOption 1:\r\n- Look in wsio.c for the call to lws_client_connect (in the function wsio_open),\r\n- Instead of passing the wsio_instance->use_ssl as argument, pass the value 2.\r\n\r\nOption 2:\r\n- We use libwebsockets for the websockets implementation (I see that you are running the WS code). The part of the code where you should look is wsio.c.\r\n- The certificate load happens in the on_ws_callback function, see the case for LWS_CALLBACK_OPENSSL_LOAD_EXTRA_CLIENT_VERIFY_CERTS. The user argument contains the OpenSSL SSL_CTX *).\r\n- You can call SSL_CTX_set_verify(user, SSL_VERIFY_NONE, NULL); to tell OpenSSL to not verify the certificate at all.\r\n\r\nAs a note for a non websocket connection you would need to do something different depending on what TLS adapter you use.\r\n\r\nLet us know if this works for you.\r\n\r\nAlso, I am not sure I understood this statement: \" Actually I am already doing all the certificate validations manually before connect to the cloud. \"\r\nWhen using TLS, the certificate is typically sent by the server to the client, the client then checks the validity of the cert information that was just sent by the server.\r\nThus, I do not think you can validate the server cert upfront before connecting, so I have probably missed something here.\r\n\r\nLet us know what your case is as we would like to help you the best way we can secure your connection to the cloud and avoid any attacks on your system.\r\n\r\nThanks,\r\n/Dan\r\n"}}
{"actor":{"display_login":"dcristoloveanu"}}