mirrors/synapse
1
0
Fork 0
mirror of https://github.com/element-hq/synapse.git synced 2024-12-21 12:14:29 +03:00
Code Issues Projects Releases Packages Wiki Activity

Use platformTrust instead of verify=True

Browse source
This commit is contained in:
Andrew Morgan 2019-04-02 11:09:43 +01:00
parent fec0c9a074
commit aeffa4d84a
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
synapse/crypto/context_factory.py
View file

@ -21,7 +21,7 @@ from OpenSSL import SSL, crypto
from twisted.internet._sslverify import _defaultCurveName
from twisted.internet.abstract import isIPAddress, isIPv6Address
from twisted.internet.interfaces import IOpenSSLClientConnectionCreator
from twisted.internet.ssl import CertificateOptions, ContextFactory
from twisted.internet.ssl import CertificateOptions, ContextFactory, platformTrust
from twisted.python.failure import Failure
logger = logging.getLogger(__name__)
@ -132,14 +132,17 @@ class ClientTLSOptionsFactory(object):
# Check if we're using a custom list of a CA certificates
if config.federation_custom_ca_list is not None:
self._options_validate = CertificateOptions(
# This option implies verify=True
# Use custom CA trusted root certs
trustRoot=config.federation_custom_ca_list,
)
else:
# If not, verify using those provided by the operating environment
self._options_validate = CertificateOptions(verify=True)
self._options_validate = CertificateOptions(
# Use CA root certs provided by OpenSSL
trustRoot=platformTrust(),
)
self._options_novalidate = CertificateOptions(verify=False)
self._options_novalidate = CertificateOptions()
def get_options(self, host):
# Use _makeContext so that we get a fresh OpenSSL CTX each time.