Provide an ability to ignore invalid (self-signed) certificate per host for federation #834

New issue

Open

opened 2025-05-22 02:31:21 +00:00 by gan · 0 comments

gan commented

2025-05-22 02:31:21 +00:00

Related: Add config option for ignoring TLS validation for certain domains/wildcarded domains, but I proposed a potentially different solution, but however I'm not fully aware of its security implications.

Generally-speaking the ability to either skip validation or trust TLS certificates would make running non-IP-based overlays (e.g. tor, i2p) easy. also to note any IP-based overlays (e.g. Yggdrasil, Mycelium) doesn't really need this feature as they can piggyback off clearnet DNS domains, but in the case if somebody would run a DNS server within those overlays, it'd become once again impossible to get a certificate.

So far, the only use case for this that I see is the ability to mix globalnet, and overlays/altnets when it's either difficult to get a proper certificate or simply impossible, Probably the ideal way to do that would be to provide an option within `[[global.proxy.by_domain]]` to ignore invalid certificates. Related: [Add config option for ignoring TLS validation for certain domains/wildcarded domains](https://forgejo.ellis.link/continuwuation/continuwuity/issues/108), but I proposed a potentially different solution, but however I'm not fully aware of its security implications. Generally-speaking the ability to either skip validation or trust TLS certificates would make running non-IP-based overlays (e.g. tor, i2p) easy. also to note any IP-based overlays (e.g. Yggdrasil, Mycelium) doesn't really need this feature as they can piggyback off clearnet DNS domains, but in the case if somebody would run a DNS server within those overlays, it'd become once again impossible to get a certificate.