{"action":"created","issue":{"url":"https://api.github.com/repos/warmcat/libwebsockets/issues/1214","repository_url":"https://api.github.com/repos/warmcat/libwebsockets","labels_url":"https://api.github.com/repos/warmcat/libwebsockets/issues/1214/labels{/name}","comments_url":"https://api.github.com/repos/warmcat/libwebsockets/issues/1214/comments","events_url":"https://api.github.com/repos/warmcat/libwebsockets/issues/1214/events","html_url":"https://github.com/warmcat/libwebsockets/issues/1214","id":307357853,"number":1214,"title":"SSL verification skipped with mbedTLS and no CA provided","user":{"login":"Faless","id":1687918,"avatar_url":"https://avatars2.githubusercontent.com/u/1687918?v=4","gravatar_id":"","url":"https://api.github.com/users/Faless","html_url":"https://github.com/Faless","followers_url":"https://api.github.com/users/Faless/followers","following_url":"https://api.github.com/users/Faless/following{/other_user}","gists_url":"https://api.github.com/users/Faless/gists{/gist_id}","starred_url":"https://api.github.com/users/Faless/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Faless/subscriptions","organizations_url":"https://api.github.com/users/Faless/orgs","repos_url":"https://api.github.com/users/Faless/repos","events_url":"https://api.github.com/users/Faless/events{/privacy}","received_events_url":"https://api.github.com/users/Faless/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-21T18:02:07Z","updated_at":"2018-03-21T22:53:09Z","closed_at":null,"author_association":"NONE","body":"As a follow-up from the discussion in #1128 .\r\n\r\n**The problem**\r\n\r\nWhen using the mbedTLS backend and no CA is provided any certificate is accepted by the client as specified here:\r\nhttps://github.com/warmcat/libwebsockets/blob/d2bc2d17043ff373c8f2c54cd3eff473078aa16f/lib/tls/mbedtls/mbedtls-client.c#L75-L79\r\n\r\n**Expected behaviour**\r\n\r\nAll SSL connections should fail when in strict mode (`LCCSCF_USE_SSL`).\r\n\r\n**My suggestion**\r\n\r\nUse `SSL_set_verify(wsi->ssl, SSL_VERIFY_PEER, OpenSSL_client_verify_callback);` in any case and fail when no CA is provided.\r\n\r\nor\r\n\r\nAlways use `MBEDTLS_SSL_VERIFY_OPTIONAL` internally, and then implement the desired behaviour in the `ssl_pm_get_verify_result` function (this should also allow to implement the less strict options there like self signed certs, hostname verification, etc).\r\nhttps://github.com/warmcat/libwebsockets/blob/d2bc2d17043ff373c8f2c54cd3eff473078aa16f/lib/tls/mbedtls/wrapper/platform/ssl_pm.c#L762\r\n\r\nIf can make a PR if you are interested.\r\n**Thank you for your amazing work on this library.**\r\nAs I'm here, I'd like to let you know that we are integrating `libwebsockets` as a third party library in Godot Engine (see https://github.com/godotengine/godot and  https://github.com/godotengine/godot/blob/master/thirdparty/README.md#libwebsockets )"},"comment":{"url":"https://api.github.com/repos/warmcat/libwebsockets/issues/comments/375122103","html_url":"https://github.com/warmcat/libwebsockets/issues/1214#issuecomment-375122103","issue_url":"https://api.github.com/repos/warmcat/libwebsockets/issues/1214","id":375122103,"user":{"login":"lws-team","id":15154525,"avatar_url":"https://avatars2.githubusercontent.com/u/15154525?v=4","gravatar_id":"","url":"https://api.github.com/users/lws-team","html_url":"https://github.com/lws-team","followers_url":"https://api.github.com/users/lws-team/followers","following_url":"https://api.github.com/users/lws-team/following{/other_user}","gists_url":"https://api.github.com/users/lws-team/gists{/gist_id}","starred_url":"https://api.github.com/users/lws-team/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lws-team/subscriptions","organizations_url":"https://api.github.com/users/lws-team/orgs","repos_url":"https://api.github.com/users/lws-team/repos","events_url":"https://api.github.com/users/lws-team/events{/privacy}","received_events_url":"https://api.github.com/users/lws-team/received_events","type":"User","site_admin":false},"created_at":"2018-03-21T22:53:09Z","updated_at":"2018-03-21T22:53:09Z","author_association":"OWNER","body":"Thanks... I guess ideally it should do the same as openssl and load the OS trust store in addition to VERIFY_OPTIONAL.  If you can provide a PR for the VERIFY_OPTIONAL bit at least it'd be a big help.  I think loading the OS trust store is going to be quite platform-dependent..."}}
{"actor":{"display_login":"lws-team"}}