diff options
| author | Matthew Fennell <matthew@fennell.dev> | 2024-06-17 22:27:17 +0100 |
|---|---|---|
| committer | fiaxh <fiaxh@users.noreply.github.com> | 2024-06-29 11:54:08 +0200 |
| commit | f55b27716a50e80c4eb0661ea3ec284ec559fc5b (patch) | |
| tree | 3d02dc635ef43d87548396993b9d7b09dd6a90dc /plugins/omemo/src/protocol | |
| parent | da4ded964f122ffef194d3f7d7cf7fd0fd71d8cf (diff) | |
| download | dino-f55b27716a50e80c4eb0661ea3ec284ec559fc5b.tar.gz dino-f55b27716a50e80c4eb0661ea3ec284ec559fc5b.zip | |
Allow self-signed .onion file transfer certs (#1149)
Most Certificate Authorities don't support issuing X.509 certificates for onion
sites. However, it can still be useful to provide a certificate over Tor in
some circumstances, for instance to tie your alphanumeric Tor address to your
site's main identity.
Therefore, many Tor services provide self-signed certificates. This is OK,
since the onion service itself guarantees that you are connecting to the entity
you think you are.
Dino already allows self-signed certs when communicating over Tor (see
81a5505). However, the same exception does not exist yet for HTTP uploads and
downloads - causing these to fail over Tor.
Therefore, in this commit, we add the same exception for uploads/downloads, by
passing the host of the upload/download urls to the already existing invalid
certificate connection handler.
Note that this handler only allows certificates with type
TlsCertificateFlags.UNKNOWN_CA. This means the certificate of your server must
also include the onion http upload and download URLs in its certificate -
otherwise, the file transfer will fail with TlsCertificateFlags.BAD_IDENTITY.
Diffstat (limited to 'plugins/omemo/src/protocol')
0 files changed, 0 insertions, 0 deletions