Skip to content

fix: enable TLS certificate verification in FileTransporter #97

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alessandro-bitetto wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: enable TLS certificate verification in FileTransporter #97

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9a86ca2
fix: enable TLS certificate verification in FileTransporter
alessandro-bitetto Jun 12, 2026
16039be
Merge branch 'main' into fix/tls-verify-filetransporter
alessandro-bitetto Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 12 additions & 10 deletions Common/Network/FileTransporter/src/FileTransporter_curl.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,11 +113,12 @@ namespace NSNetwork
//curl_easy_setopt(curl, CURLOPT_NOPROGRESS, FALSE);
// Install the callback function
//curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_func);
#if defined(__linux__)
//Linux doesn't have root certificates built into the system, so we disable verification
//http://curl.haxx.se/docs/sslcerts.html
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
#endif
// Verify the peer's TLS certificate against the system CA store.
// These are libcurl defaults; set explicitly so the bypass is not
// reintroduced. If a platform lacks a default CA bundle, configure
// it via CURLOPT_CAINFO/CURLOPT_CAPATH rather than disabling verification.
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
/* tell libcurl to follow redirection(default false) */
curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
/* some servers don't like requests that are made without a user-agent field, so we provide one */
Expand Down Expand Up @@ -173,11 +174,12 @@ namespace NSNetwork
curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data_to_string);
curl_easy_setopt(curl, CURLOPT_WRITEDATA, &readBuffer);

#if defined(__linux__)
//Linux doesn't have root certificates built into the system, so we disable verification
//http://curl.haxx.se/docs/sslcerts.html
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
#endif
// Verify the peer's TLS certificate against the system CA store.
// These are libcurl defaults; set explicitly so the bypass is not
// reintroduced. If a platform lacks a default CA bundle, configure
// it via CURLOPT_CAINFO/CURLOPT_CAPATH rather than disabling verification.
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);

/* Perform the request, res will get the return code */
res = curl_easy_perform(curl);
Expand Down