# [Patch reminder] Don't verify host name in SSL certs when GIT_SSL_NO_VERIFY is set 2 messages from 2008-09-07 to 2008-09-07. Participants: Mike Hommey, Junio C Hamano. Thread: https://gitlist.dev/t/15403 ## Mike Hommey, 2008-09-07 08:20 Subject: [Patch reminder] Don't verify host name in SSL certs when GIT_SSL_NO_VERIFY is set Message-ID: <20080907082059.GA26705@glandium.org> URL: https://gitlist.dev/e/20080907082059.GA26705%40glandium.org ``` Hi, While rebasing old branches on master, I saw that I still had this patch[1] ahead, to which you replied with [2]. I might be guilty of not replying back then, but I think your version should be applied. Cheers, Mike 1. http://marc.info/?l=git&m=120362183916288&w=2 2. http://marc.info/?l=git&m=120363548506950&w=2 ``` ## Junio C Hamano, 2008-09-07 08:35 Subject: Re: [Patch reminder] Don't verify host name in SSL certs when GIT_SSL_NO_VERIFY is set Message-ID: <7v7i9onyj9.fsf@gitster.siamese.dyndns.org> URL: https://gitlist.dev/e/7v7i9onyj9.fsf%40gitster.siamese.dyndns.org In-Reply-To: <20080907082059.GA26705@glandium.org> ``` Subject: Don't verify host name in SSL certs when GIT_SSL_NO_VERIFY is set Date: Thu, 21 Feb 2008 15:10:37 -0800 Signed-off-by: Junio C Hamano --- Mike Hommey writes: > While rebasing old branches on master, I saw that I still had this > patch[1] ahead, to which you replied with [2]. I might be guilty of not > replying back then, but I think your version should be applied. > > 1. http://marc.info/?l=git&m=120362183916288&w=2 > 2. http://marc.info/?l=git&m=120363548506950&w=2 Thanks. Just to make sure we are on the same page and to give other people comment on and potentially offer better solution, this is the patch in question. Next time around, please forward/resend "old patches that should not have been forgotten" in the way I am doing here. diff --git a/http.c b/http.c index 5925d07..8dce820 100644 --- a/http.c +++ b/http.c @@ -176,7 +176,16 @@ static CURL* get_curl_handle(void) { CURL* result = curl_easy_init(); - curl_easy_setopt(result, CURLOPT_SSL_VERIFYPEER, curl_ssl_verify); + if (!curl_ssl_verify) { + curl_easy_setopt(result, CURLOPT_SSL_VERIFYPEER, 0); + curl_easy_setopt(result, CURLOPT_SSL_VERIFYHOST, 0); + } else { + /* Verify authenticity of the peer's certificate */ + curl_easy_setopt(result, CURLOPT_SSL_VERIFYPEER, 1); + /* The name in the cert must match whom we tried to connect */ + curl_easy_setopt(result, CURLOPT_SSL_VERIFYHOST, 2); + } + #if LIBCURL_VERSION_NUM >= 0x070907 curl_easy_setopt(result, CURLOPT_NETRC, CURL_NETRC_OPTIONAL); #endif ```