Don't run validation code if validation is turned off

synapse/config/tls.py

@@ -90,10 +90,11 @@ class TlsConfig(Config):
 
         # List of custom certificate authorities for federation traffic validation
         self.federation_custom_ca_list = config.get(
-            "federation_custom_ca_list", [],
+            "federation_custom_ca_list", None,
         )
 
         # Read in and parse custom CA certificates
+        if self.federation_custom_ca_list is not None:
             certs = []
             for ca_file in self.federation_custom_ca_list:
                 logger.debug("Reading custom CA certificate file: %s", ca_file)
@@ -112,6 +113,7 @@ class TlsConfig(Config):
                     logger.exception("Failed to parse custom CA certificate off disk!")
                     raise
 
+            if len(certs) > 0:
                 self.federation_custom_ca_list = trustRootFromCertificates(certs)
 
         # This config option applies to non-federation HTTP clients

synapse/crypto/context_factory.py

@@ -128,10 +128,17 @@ class ClientTLSOptionsFactory(object):
 
     def __init__(self, config):
         self._config = config
+
+        # Check if we're using a custom list of a CA certificates
+        if config.federation_custom_ca_list is not None:
             self._options_validate = CertificateOptions(
                 # This option implies verify=True
                 trustRoot=config.federation_custom_ca_list,
             )
+        else:
+            # If not, verify using those provided by the operating environment
+            self._options_validate = CertificateOptions(verify=True)
+
         self._options_novalidate = CertificateOptions(verify=False)
 
     def get_options(self, host):

tests/http/federation/test_matrix_federation_agent.py

@@ -53,7 +53,7 @@ class MatrixFederationAgentTests(TestCase):
 
         self.agent = MatrixFederationAgent(
             reactor=self.reactor,
-            tls_client_options_factory=ClientTLSOptionsFactory(None),
+            tls_client_options_factory=ClientTLSOptionsFactory(#TODO How to deal with None config in tests???),
             _well_known_tls_policy=TrustingTLSPolicyForHTTPS(),
             _srv_resolver=self.mock_resolver,
             _well_known_cache=self.well_known_cache,