TLS client disables certificate verification when no CA is provided #118

New Issue

2026-07-21T16:20:52+02:00

TapTap commented

2026-07-21 16:20:52 +02:00

Description

When no CA path is provided via --ca, SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL) disables all certificate verification (transport_tls.c:82). While X509_VERIFY_PARAM_set1_host() is called for SNI, without SSL_VERIFY_PEER the certificate chain is never validated, so MITM attacks are trivial. There is no --insecure flag to explicitly opt into this.

Location

src/shared/transport_tls.c:77-83

How to trigger

Connect to a TLS server without providing --ca. The client will connect to any server presenting any certificate, including self-signed or fraudulent ones. A MITM attacker between client and server can intercept all data.

Suggested Fix

By default, use the system CA store via SSL_CTX_set_default_verify_paths(ctx)
Only disable verification with an explicit --insecure flag (which currently does not exist)
When --ca is provided, use it and enforce SSL_VERIFY_PEER

Severity

medium

Sub-Agent

security-screener (SC-7)

This issue was automatically generated by the issue-creator agent.

## Description When no CA path is provided via `--ca`, `SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL)` disables all certificate verification (transport_tls.c:82). While `X509_VERIFY_PARAM_set1_host()` is called for SNI, without `SSL_VERIFY_PEER` the certificate chain is never validated, so MITM attacks are trivial. There is no `--insecure` flag to explicitly opt into this. ## Location src/shared/transport_tls.c:77-83 ## How to trigger Connect to a TLS server without providing `--ca`. The client will connect to any server presenting any certificate, including self-signed or fraudulent ones. A MITM attacker between client and server can intercept all data. ## Suggested Fix 1. By default, use the system CA store via `SSL_CTX_set_default_verify_paths(ctx)` 2. Only disable verification with an explicit `--insecure` flag (which currently does not exist) 3. When `--ca` is provided, use it and enforce `SSL_VERIFY_PEER` ## Severity medium ## Category security ## Sub-Agent security-screener (SC-7) --- _This issue was automatically generated by the issue-creator agent._

TapTap referenced this issue

2026-07-21 16:48:29 +02:00

Security hardening: path traversal, TLS verification, DOS protections (#112-#118) #138

TapTap closed this issue

2026-07-29 18:27:14 +02:00

TapTap commented

2026-07-29 18:27:32 +02:00