search

snoyberg / http-enumerator

HTTP client package with enumerator interface and HTTPS support.
27 stars 9 forks source link

Controlling SSL certificate checks #2

Closed iustin closed 13 years ago

iustin commented 13 years ago

I couldn't find out how I can control the SSL certificate verification:

> simpleHttp "https://74.125.232.113/"
Chunk "<!doctype html>  …

As opposed to:

$ curl https://74.125.232.113 
curl: (51) SSL: certificate subject name 'www.google.com' does not match target host name '74.125.232.113'

Could you please either document this or implement it?

thanks! iustin

aristidb commented 13 years ago

It does not check certificates? That is bad! Does that depend on whether you use tls or HsOpenSSL?

snoyberg commented 13 years ago

I've put in a request for the tls package to expose certificate functionality. Hopefully this will make it into http-enumerator 0.4

snoyberg commented 13 years ago

Upon further inspection, the code is already available in tls. I've added a field checkCerts to the Request datatype. Does this resolve the issue?

iustin commented 13 years ago

I would say that this is the minimum needed to implement checking. If I read that commit correctly, one will have to use parseUrl2, then update the request with their own checkCerts. This is good.

However, I believe that what most people will do is reimplement this: "given these CA certificates, and this hostname, does the subjectDN match the hostname and is signed by a valid CA?" but forget to do proper checking of corner cases (CertKeyUsage, etc.). So probably the certificate package should expose some helpers for common cases.

Anyway, this does not belong in http-enumerator, so I think this bug can be closed. Thanks a lot!

snoyberg commented 13 years ago

And thank you for recommending the feature.