Validating Self-Signed Certificate

[brannonh]

Hello,

I just implemented Got in a project where we are connecting to a partner's API. They are utilizing a self-signed certificate (behind a VPN tunnel) that I would like to validate, however they will only provide the client version of their certificate, citing security risks to providing the server version of the cert and their private key.

My question is am I able to validate the certificate with just the client version through Got? I would prefer not disabling certificate validation if I can help it.

Thanks!

[brannonh]

🦗 🦗 🦗

I'm assuming by the silence that this is not currently supported. Is that accurate?

[Giotino]

You can use https.checkServerIdentity.

[brannonh]

I saw that, but per the docs at that link...

Note: In order to have the function called the certificate must not be expired, self-signed or with an untrusted-root.

My question is specifically about a self-signed certificate.

[szmarczak]

I haven't checked this. Have you tried it anyway?

[szmarczak]

I think you need to update trusted CAs https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options

[brannonh]

I did not check it, due to the docs. If there's uncertainty about whether or not the docs are accurate, I'm happy to test it. Will let you guys know.

[brannonh]

Okay, thanks, @szmarczak. Will look into that also.