aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/doc/src
diff options
context:
space:
mode:
authorMagnus Henoch <[email protected]>2016-01-29 18:47:43 +0000
committerMagnus Henoch <[email protected]>2016-02-17 10:05:26 +0000
commita567dca5ea418a0aaaed8fb4359032b11f28cccd (patch)
tree06e623b56e43f70e14b4019dc8a4783e0f966a1b /lib/ssl/doc/src
parent6945881b99aeadaf9ed4ec1f8c7811538cee1405 (diff)
downloadotp-a567dca5ea418a0aaaed8fb4359032b11f28cccd.tar.gz
otp-a567dca5ea418a0aaaed8fb4359032b11f28cccd.tar.bz2
otp-a567dca5ea418a0aaaed8fb4359032b11f28cccd.zip
ssl: with verify_none, accept critical extensions
When establishing a TLS connection with {verify, verify_none}, if the server has a certificate with a critical extension, for example a "Netscape Cert Type" extension, certificate verification would fail, which is surprising given that the name of the option suggests that no verification would be performed. With this change, certificate extensions marked as critical are ignored when using verify_none.
Diffstat (limited to 'lib/ssl/doc/src')
-rw-r--r--lib/ssl/doc/src/ssl.xml8
1 files changed, 7 insertions, 1 deletions
diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index bf87644116..ca5d2afc24 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -269,7 +269,11 @@ atom()}} |
terminate regarding verification failures and the connection is
established.</p></item>
<item><p>If called with an extension unknown to the user application,
- return value <c>{unknown, UserState}</c> is to be used.</p></item>
+ return value <c>{unknown, UserState}</c> is to be used.</p>
+
+ <p>Note that if the fun returns <c>unknown</c> for an extension marked
+ as critical, validation will fail.</p>
+ </item>
</list>
<p>Default option <c>verify_fun</c> in <c>verify_peer mode</c>:</p>
@@ -291,6 +295,8 @@ atom()}} |
<code>
{fun(_,{bad_cert, _}, UserState) ->
{valid, UserState};
+ (_,{extension, #'Extension'{critical = true}}, UserState) ->
+ {valid, UserState};
(_,{extension, _}, UserState) ->
{unknown, UserState};
(_, valid, UserState) ->