diff options
| author | Magnus Henoch <magnus@erlang-solutions.com> | 2016-01-29 18:47:43 +0000 |
|---|---|---|
| committer | Magnus Henoch <magnus@erlang-solutions.com> | 2016-02-17 10:05:26 +0000 |
| commit | a567dca5ea418a0aaaed8fb4359032b11f28cccd (patch) | |
| tree | 06e623b56e43f70e14b4019dc8a4783e0f966a1b /lib/ssl/doc | |
| parent | 6945881b99aeadaf9ed4ec1f8c7811538cee1405 (diff) | |
| download | erlang-a567dca5ea418a0aaaed8fb4359032b11f28cccd.tar.gz | |
ssl: with verify_none, accept critical extensions
When establishing a TLS connection with {verify, verify_none}, if the
server has a certificate with a critical extension, for example a
"Netscape Cert Type" extension, certificate verification would fail,
which is surprising given that the name of the option suggests that no
verification would be performed.
With this change, certificate extensions marked as critical are
ignored when using verify_none.
Diffstat (limited to 'lib/ssl/doc')
| -rw-r--r-- | lib/ssl/doc/src/ssl.xml | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml index bf87644116..ca5d2afc24 100644 --- a/lib/ssl/doc/src/ssl.xml +++ b/lib/ssl/doc/src/ssl.xml @@ -269,7 +269,11 @@ atom()}} | terminate regarding verification failures and the connection is established.</p></item> <item><p>If called with an extension unknown to the user application, - return value <c>{unknown, UserState}</c> is to be used.</p></item> + return value <c>{unknown, UserState}</c> is to be used.</p> + + <p>Note that if the fun returns <c>unknown</c> for an extension marked + as critical, validation will fail.</p> + </item> </list> <p>Default option <c>verify_fun</c> in <c>verify_peer mode</c>:</p> @@ -291,6 +295,8 @@ atom()}} | <code> {fun(_,{bad_cert, _}, UserState) -> {valid, UserState}; + (_,{extension, #'Extension'{critical = true}}, UserState) -> + {valid, UserState}; (_,{extension, _}, UserState) -> {unknown, UserState}; (_, valid, UserState) -> |