[erlang-questions] What lib to use for http requests
Sun Dec 14 22:27:52 CET 2014
Nice. Is there any CRL or OCSP integration implemented or planned?
> On Dec 14, 2014, at 4:24 PM, Benoit Chesneau <bchesneau@REDACTED> wrote:
>> On Fri, Dec 12, 2014 at 10:18 PM, Drew Varner <drew.varner@REDACTED> wrote:
>> If you are communicating to servers via HTTPS, Hackney and other HTTP clients allow you to pass options to the underlying SSL/TLS socket, including some verification of the peer certificate. For example:
>> Gun has an open issue to address this (https://github.com/extend/gun/pull/27), but it is not implemented. If you use Gun as your HTTPS client, you’re open to man-in-the-middle attacks.
>> Do not fall into a false sense of security that any Erlang HTTPS clients provide complete protection against man-in-the-middle attacks out of the box. You’ll also want to consider cases where your peer certificate was revoked by a Certificate Authority. You’d want to know how your HTTPS client handles certificates when their revocation data has been published via a CRL or OCSP. CRL verification has made some headway in Erlang (see the ssl module docs and https://github.com/Vagabond/erl_crl_example). You’ll also want to look at hostname verification (https://github.com/deadtrickster/ssl_verify_hostname.erl).
>> HTTPS is as secure as you make it.
> Just to expand a little bit, now on latest stable erlang versions of SSL hackney 1.0.x is by default checking SSL certificates and their hostname.
> - benoit
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the erlang-questions