Closed ynuwenhof closed 1 week ago
Hi @ynuwenhof, welcome to ureq!
Disabling certificate verification is a contentious issue. Some library authors would say it should be hard to disable it, others don't. It would be interesting to know what some other libraries do, like reqwest
, curl
, urllib3
for example.
Reqwest provides the convenience function danger_accept_invalid_certs
on their ClientBuilder
as for curl IIRC you can simply add the --insecure
flag.
Martin Algesten @.***> wrote:
Disabling certificate verification is a contentious issue. Some library authors would say it should be hard to disable it, others don't. It would be interesting to know what some other libraries do, like
reqwest
,curl
,urllib3
for example.
In my use case (RFC8995), I need to disable it, because it's a private PKI anchor. But, it will be validated later via other means. My opinion is that it should be done by providing an object that will do the validation as it sees fit. (Yes, a callback)
Closing since we're moving to ureq 3.x. This is solved in ureq 3.x
The current process of configuring ureq to trust invalid certificates is a bit annoying since you have to figure out the correct rustls version based on the ureq version you are using and then create a
ClientConfig
and custom catch allServerCertVerifier
. A simple convenience function or example in the documentation would be great.