Bug #5903: rudder-metrics-reporting is relying on local CA bundles to validate https - Rudder - Issue Tracker

Actions

Copy link

Bug #5903

closed

rudder-metrics-reporting is relying on local CA bundles to validate https

Added by Matthieu CERDA almost 10 years ago. Updated almost 10 years ago.

Status:

Released

Priority:

1 (highest)

Assignee:

Matthieu CERDA

Category:

System integration

Target version:

3.0.0~beta2

Pull Request:

https://github.com/Normation/rudder-p...

Severity:

UX impact:

User visibility:

Effort required:

Priority:

Name check:

Fix check:

Regression:

Description

We do not have any control over what CA's are registered in people machines, and often those CA bundle fail to validate our certificate for feedback.rudder-project.org

We should either disable validation using -k or provide our own CA bundles to validate the connection.

What do you think ?

Actions

Copy link

Updated by Jonathan CLARKE almost 10 years ago

Since the data sent is anonymous, why use https at all? I think a http connection would be just fine.

I'm against using -K because this disables certificate checking and can give a false illusion of security.

Actions

Copy link

Updated by François ARMAND almost 10 years ago

The data is anonymised, but at the moment of the send, someone can intercept the connection (typical man in the middle attack, for ex. with dns poisoning on the url for feedback) and then know who sent the information and learn things that should not be public about the internal infra of the user.

So I think we should encrypt the connection.

Actions

Copy link