IXWebSocket icon indicating copy to clipboard operation
IXWebSocket copied to clipboard

Add option to disable hostname check

Open rsmmr opened this issue 2 years ago • 2 comments

This adds a new option that disables the hostname check for received certificates. This is useful in setups where one knows that a host's name won't align with the certificate.

The option is only implemented for OpenSSL right now, as that's where I need it. I can't easily test the other SSL implementations, so I figured I submit this as is for now to see what you think about it.

rsmmr avatar Jun 30 '22 18:06 rsmmr

Thanks for contributing, I'm fine with this change (it's always convenient to disable some stuff, but keep the default safe), but it would be best if you could change the ws cli tool to add an option to do so, and hunt around in the mbedtls code, there is probably an easy way to do that as well.

Could you also add a note in the markdown doc file (usage.md) ? https://github.com/machinezone/IXWebSocket/blob/master/docs/usage.md#tls-support-and-configuration

The cherry on the cake would be a unittest, does https://badssl.com/ has an endpoint for this ?

bsergean avatar Jul 13 '22 12:07 bsergean

Thanks for the feedback. I'll take a stab at it, but it might take me a bit.

rsmmr avatar Jul 14 '22 06:07 rsmmr

Updated this as requested, take a look. I added support to Apple SSL as well, but can't test that one because my tests spawns up an SSL server, which seems unsupported with Apple SSL. (Couldn't get the badssl.com endpoint to work and this might be the better test anyways.)

I added a couple of maintainance commits at the beginning, let me know if you'd rather not have them included.

rsmmr avatar Aug 24 '22 16:08 rsmmr

Sorry I missed your update, will take a look soon.

bsergean avatar Oct 12 '22 13:10 bsergean

Thanks !

bsergean avatar Oct 12 '22 13:10 bsergean