Details
-
Improvement
-
Status: Closed
-
Major
-
Resolution: Fixed
-
3.0
-
Security Level: Public
-
None
-
CBG Sprint 68, CBG Sprint 69, CBG Sprint 70
-
3
Description
Sync Gateway supports loading JavaScript content from external HTTP/HTTPs endpoints. In case of an HTTPS endpoint, the underlying SSL connection attempted to be made secure by using the CA certificate bundle installed on the SG node by default. This means that you may encounter an SSL verification error when you try to load JavaScript from external HTTPS endpoints with the SSL certificates that are misconfigured, expired, or self-signed. We should have a mechanism to force SG to ignore the certificate errors by specifying the remote_config_tls_skip_verify option in the database configuration. SG should ignore the SSL checks when initiating the connection by using the remote_config_tls_skip_verify option and you should be able to bypass any SSL error that any external JavaScript endpoint might have.
Attachments
Activity
| Field | Original Value | New Value |
|---|---|---|
| Sprint | CBG Sprint 68 [ 1473 ] | CBG Sprint 68, CBG Sprint 69 [ 1473, 1491 ] |
| Status | Open [ 1 ] | In Progress [ 3 ] |
Automated transition triggered when Sarath Kumar Sivan created pull request #4977 in GitHub -
| Status | In Progress [ 3 ] | In Review [ 10107 ] |
| Sprint | CBG Sprint 68, CBG Sprint 69 [ 1473, 1491 ] | CBG Sprint 68, CBG Sprint 69, CBG Sprint 70 [ 1473, 1491, 1508 ] |
Automated transition triggered when Adam Fraser merged pull request #4977 in GitHub -
| Resolution | Fixed [ 1 ] | |
| Status | In Review [ 10107 ] | Resolved [ 5 ] |
Build sync_gateway-3.0.0-166 contains sync_gateway commit e684798 with commit message:
CBG-1337 Add an option to skip TLS certificates verification while loading JavaScript from HTTPS endpoints (#4977)
| Status | Resolved [ 5 ] | Closed [ 6 ] |
| Resolution | Fixed [ 1 ] | |
| Status | Closed [ 6 ] | Reopened [ 4 ] |
| Affects Version/s | Lithium [ 16180 ] |
| Resolution | Fixed [ 1 ] | |
| Status | Reopened [ 4 ] | Resolved [ 5 ] |
| Status | Resolved [ 5 ] | Closed [ 6 ] |
Today we’ve two multiple configurations for enabling self signed certificates and introducing another option doesn’t seem to be a good approach. Need to review the feasibility of setting this option globally and override at the feature level if that’s needed. We also want to see how the same feature is handled in other applications and what the common best practices are. Checking about how to accept self signed certificates at the OS level is also useful.