<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} .ms-cui-menu {background-color:#ffffff;border:1px rgb(171, 171, 171) solid;font-family:'Segoe UI WPC', 'Segoe UI', Tahoma, 'Microsoft Sans Serif', Verdana, sans-serif;font-size:11pt;color:rgb(51, 51, 51);} .ms-cui-menusection-title {display:none;} .ms-cui-ctl {vertical-align:text-top;text-decoration:none;color:rgb(51, 51, 51);} .ms-cui-ctl-on {background-color:rgb(223, 237, 250);opacity: 0.8;} .ms-cui-img-cont-float {display:inline-block;margin-top:2px} .ms-cui-smenu-inner {padding-top:0px;} .ms-owa-paste-option-icon {margin: 2px 4px 0px 4px;vertical-align:sub;padding-bottom: 2px;display:inline-block;} .ms-rtePasteFlyout-option:hover {background-color:rgb(223, 237, 250) !important;opacity:1 !important;} .ms-rtePasteFlyout-option {padding:8px 4px 8px 4px;outline:none;} .ms-cui-menusection {float:left; width:85px;height:24px;overflow:hidden}.wf {speak:none; font-weight:normal; font-variant:normal; text-transform:none; -webkit-font-smoothing:antialiased; vertical-align:middle; display:inline-block;}.wf-family-owa {font-family:'o365Icons'}@font-face { font-family:'o365IconsIE8'; src:url('https://r4.res.outlook.com/owa/prem/15.0.918.10/resources/styles/office365icons.ie8.eot?#iefix') format('embedded-opentype'), url('https://r4.res.outlook.com/owa/prem/15.0.918.10/resources/styles/office365icons.ie8.woff') format('woff'), url('https://r4.res.outlook.com/owa/prem/15.0.918.10/resources/styles/office365icons.ie8.ttf') format('truetype'); font-weight:normal; font-style:normal;}@font-face { font-family:'o365IconsMouse'; src:url('https://r4.res.outlook.com/owa/prem/15.0.918.10/resources/styles/office365icons.mouse.eot?#iefix') format('embedded-opentype'), url('https://r4.res.outlook.com/owa/prem/15.0.918.10/resources/styles/office365icons.mouse.woff') format('woff'), url('https://r4.res.outlook.com/owa/prem/15.0.918.10/resources/styles/office365icons.mouse.ttf') format('truetype'); font-weight:normal; font-style:normal;}.wf-family-owa {font-family:'o365IconsMouse'}.ie8 .wf-family-owa {font-family:'o365IconsIE8'}.ie8 .wf-owa-play-large:before {content:'\e254';}.notIE8 .wf-owa-play-large:before {content:'\e054';}.ie8 .wf-owa-play-large {color:#FFFFFF/*$WFWhiteColor*/;}.notIE8 .wf-owa-play-large {border-color:#FFFFFF/*$WFWhiteColor*/; width:1.4em; height:1.4em; border-width:.1em; border-style:solid; border-radius:.8em; text-align:center; box-sizing:border-box; -moz-box-sizing:border-box; padding:0.1em; color:#FFFFFF/*$WFWhiteColor*/;}.ie8 .wf-size-play-large {width:40px; height:40px; font-size:30px}.notIE8 .wf-size-play-large {width:40px; height:40px; font-size:30px}--></style>
</head>
<body dir="ltr">
<div id="OWAFontStyleDivID" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>But as I reported in this issue https://github.com/benoitc/hackney/issues/101 I tested against a server with an invalid cert, and hackney did not catch the error. httpc also returned ok.<br>
</p>
<p><br>
</p>
<p></p>
<pre style="box-sizing: border-box; font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 13px; margin-top: 15px; margin-bottom: 15px; background-color: rgb(248, 248, 248); border: 1px solid rgb(221, 221, 221); line-height: 19px; overflow: auto; padding: 6px 10px; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; word-wrap: normal; color: rgb(51, 51, 51);"><code style="box-sizing: border-box; font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 12px; margin: 0px; border: none; background-color: transparent; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; padding: 0px; word-wrap: normal; display: inline; line-height: inherit;">1> hackney:get(<<"https://localhost:8443/delay">>, [], <<>>, []).
{ok,200,
[{<<"connection">>,<<"keep-alive">>},
{<<"server">>,<<"Cowboy">>},
{<<"date">>,<<"Sat, 19 Apr 2014 00:00:26 GMT">>},
{<<"content-length">>,<<"0">>}],
#Ref<0.0.0.111>}</code><br></pre>
<p>The same happens if I pass validate_peer and the rootCA file as ssl_options.<br>
</p>
<p><br>
</p>
<p>curl correctly rejects the server:<br>
</p>
<p><br>
</p>
<pre style="box-sizing: border-box; font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 13px; margin-top: 15px; background-color: rgb(248, 248, 248); border: 1px solid rgb(221, 221, 221); line-height: 19px; overflow: auto; padding: 6px 10px; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; word-wrap: normal; color: rgb(51, 51, 51); margin-bottom: 0px !important;"><code style="box-sizing: border-box; font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 12px; margin: 0px; border: none; background-color: transparent; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; padding: 0px; word-wrap: normal; display: inline; line-height: inherit;">talko@ubuntu:~/dev/httpcbench$ curl https://localhost:8443/delay
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
talko@ubuntu:~/dev/httpcbench$ curl --cacert priv/ssl/rootCA.pem https://localhost:8443/delay
curl: (51) SSL: certificate subject name 'httpcbench server' does not match target host name 'localhost'</code><br></pre>
<p><br>
</p>
<p>This is using Erlang 17.0. Is it possible that the ssl default changed?<br>
</p>
<p><br>
</p>
<p>Or am I doing something wrong?<br>
</p>
<p><br>
</p>
<p>The server I'm testing against is in this repo: <a href="https://github.com/talko/httpcbench." id="NoLP">https://github.com/talko/httpcbench.</a> It's a work in progress, but if you pull, make and run_server you should see the same issue. <br>
</p>
<p><br>
</p>
<p>thanks,<br>
</p>
<p>Ransom<br>
</p>
<p><br>
</p>
<div style="color: rgb(40, 40, 40);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Benoit Chesneau <bchesneau@gmail.com><br>
<b>Sent:</b> Saturday, April 19, 2014 12:08 AM<br>
<b>To:</b> Ransom Richardson<br>
<b>Cc:</b> erlang-questions@erlang.org<br>
<b>Subject:</b> Re: [erlang-questions] HTTPC doesn't do HTTPS validation</font>
<div> </div>
</div>
<div>
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Sat, Apr 19, 2014 at 6:02 AM, Ransom Richardson <span dir="ltr">
<<a href="mailto:ransomr@talko.com" target="_blank">ransomr@talko.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-color:rgb(204,204,204); border-left-style:solid; padding-left:1ex">
<div dir="ltr">
<div style="font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>What I am seeing is that it is insecure by default (both httpc and hackney). I also don't see a way to make it secure. </p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>There is no such default in hackney:</div>
<div><br>
</div>
<div><a href="https://github.com/benoitc/hackney/blob/master/src/hackney_connect.erl#L201">https://github.com/benoitc/hackney/blob/master/src/hackney_connect.erl#L201</a></div>
<div><br>
</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-color:rgb(204,204,204); border-left-style:solid; padding-left:1ex">
<div dir="ltr">
<div style="font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
<p><br>
</p>
<p>Is there an option that I can pass that will cause it to validate that the cert matches the host? </p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Using the validate_fun function probably. </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-color:rgb(204,204,204); border-left-style:solid; padding-left:1ex">
<div dir="ltr">
<div style="font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Is there an easier way to turn on validation than passing [{validate, validate_peer}, {cacertfile, ...}] on every request?</p>
<p><br>
</p>
<p>It never even occurred to me that an http client would be insecure by default when connecting over https.</p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>it isn't. A lot were.</div>
<div><br>
</div>
<div>- benoit</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>