Incomplete certificate chain

Michael-F-Bryan / mdbook-linkcheck

A backend for `mdbook` which will check your links for you.

https://michael-f-bryan.github.io/mdbook-linkcheck/

MIT License

145 stars 29 forks source link

Incomplete certificate chain #19

Closed TjeuKayim closed 4 years ago

TjeuKayim commented 5 years ago

This link checker fails if the server's certificate chain is incomplete. For example, https://incomplete-chain.badssl.com/ will throw: error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1924: (unable to get local issuer certificate). Most browsers still accept this (AIA fetching).

Can mdbook-linkcheck get an option to ignore HTTPS certificates with incomplete chain? Maybe only for a whitelist of configured domains.

Michael-F-Bryan commented 5 years ago

I guess we could use reqwest::ClientBuilder::danger_accept_invalid_certs() to globally disable certificate validation when creating the HTTP client... But if the server on the other side has invalid certs most browsers will refuse to display the page, which is a pretty good definition for "broken link".

Can't you add the server to the exclude section under [output.linkcheck]?

Michael-F-Bryan commented 4 years ago

I'm going to close this issue as Wont-Fix. If your website has bad certificates then I'd argue that it is broken, and should be reported as such.