Details
-
Improvement
-
Status: Closed
-
Normal
-
Resolution: Fixed
-
None
-
None
-
None
Description
We need different levels of verification for HTTP requests depending on the state of the application (e.g. whether we have downloaded a CA cert or should do CRL checking). This state is known by the entity making the requests. Currently, the client tries to guess the right verify mode itself by trying to inspect the application state (e.g. looking for files on disk). Instead, we should have the caller request certain security configurations directly, via passing a context object to the client describing the kind of connection that should be used for the request. The client should then correctly handle cleaning up once the request has been made, for example by resetting all connections after downloading the CA bundle using VERIFY_NONE. This will help ensure that we don't accidentally downgrade connections that are supposed to be secure.
as a puppet/server dev
i want this
so that we can be explicit about the ssl verify state
Attachments
Issue Links
- relates to
-
PUP-7295 Puppet is too permissive about skipping SSL verification
-
- Closed
-