Uploaded image for project: 'Ruby Driver'
  1. Ruby Driver
  2. RUBY-1608

Implement functionality to enable/disable TLS hostname verification

    • Type: Icon: Improvement Improvement
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 2.7.0.rc0
    • Affects Version/s: None
    • Component/s: None
    • None
    • Minor Change

      Prior to OpenSSL 1.0.2, hostnames were not verified when initiating a TLS connection. Because of this, whether or not the driver defaults to verifying hostnames is dependent on the version of OpenSSL the user has installed. To ensure consistent behavior, we should create client option (and map "tlsAllowInvalidHostnames" in the URI to this option) to allow invalid hostnames and then always pass an option to OpenSSL signifying whether to verify hostnames. The logic for determining whether hostnames should be verified is the following:

       

      tlsAllowInvalidHostnames tlsInsecure option passed to OpenSSL
      unspecified unspecified verify hostnames
      unspecified false verify hostnames
      unspecified true do not verify hostnames
      false * verify hostnames
      true * do not verify hostnames

            Assignee:
            sam.rossi@mongodb.com Samuel Rossi (Inactive)
            Reporter:
            sam.rossi@mongodb.com Samuel Rossi (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: