Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ability to skip TLS server cert verification for backends #426

Open
joeshaw opened this issue Sep 11, 2024 · 0 comments
Open

Ability to skip TLS server cert verification for backends #426

joeshaw opened this issue Sep 11, 2024 · 0 comments

Comments

@joeshaw
Copy link
Member

joeshaw commented Sep 11, 2024

When defining local server backends, you should be able to specify whether you want to verify the TLS certificate for upstream requests. Currently Viceroy always verifies hostnames, which is the right default, but there is no way to disable this.

For a development tool this option is important, as a common use case is to run a server locally that is using self-signed certificates that won't verify using the system's root cert pool. In these cases we are not concerned about the hostname being verified.

In our specific case, the software we're running requires serving HTTPS, even if it's with a self-signed certificate. We have worked around Viceroy's verification requirement by running a separate nginx proxy that serves non-HTTPS and proxies to the HTTPS server with TLS certificate verification turned off, and pointing our backend to that, but this is a gross hack for functionality that should be provided by Viceroy instead.

I propose that we add a new field to the local_server.backends portion of fastly.toml to disable verification. If we want to match the VCL definition we could call this ssl_check_cert though my preference would be to avoid "ssl" terminology generally and it's not used elsewhere in fastly.toml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant