Skip to content

Ability to skip TLS server cert verification for backends #426

Open
@joeshaw

Description

@joeshaw

When defining local server backends, you should be able to specify whether you want to verify the TLS certificate for upstream requests. Currently Viceroy always verifies hostnames, which is the right default, but there is no way to disable this.

For a development tool this option is important, as a common use case is to run a server locally that is using self-signed certificates that won't verify using the system's root cert pool. In these cases we are not concerned about the hostname being verified.

In our specific case, the software we're running requires serving HTTPS, even if it's with a self-signed certificate. We have worked around Viceroy's verification requirement by running a separate nginx proxy that serves non-HTTPS and proxies to the HTTPS server with TLS certificate verification turned off, and pointing our backend to that, but this is a gross hack for functionality that should be provided by Viceroy instead.

I propose that we add a new field to the local_server.backends portion of fastly.toml to disable verification. If we want to match the VCL definition we could call this ssl_check_cert though my preference would be to avoid "ssl" terminology generally and it's not used elsewhere in fastly.toml.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions