Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[httpc] Do not read OS cacerts if verify_none #7303

Closed
maennchen opened this issue May 25, 2023 · 0 comments · Fixed by #7306
Closed

[httpc] Do not read OS cacerts if verify_none #7303

maennchen opened this issue May 25, 2023 · 0 comments · Fixed by #7306
Labels
bug Issue is reported as a bug team:PS Assigned to OTP team PS

Comments

@maennchen
Copy link
Contributor

Describe the bug

When suplying {ssl, [{verify, verify_none}]} to http, it still calls public_key:cacerts/0 internally. If there are no OS cacerts present on the machine, httpc will crash even though no certs were actually required.

To Reproduce

inets:start(),
ssl:start(),
Response = httpc:request(get, {\"https://google.com\", []}, [{ssl,[{verify, verify_none}]}], []),
erlang:display(Response).
** exception error: no match of right hand side value {error,enoent}
     in function  pubkey_os_cacerts:get/0 (pubkey_os_cacerts.erl, line 38)
     in call from httpc:ssl_verify_host_options/1 (httpc.erl, line 476)
     in call from httpc:http_options_default/0 (httpc.erl, line 1012)
     in call from httpc:http_options/1 (httpc.erl, line 927)
     in call from httpc:handle_request/9 (httpc.erl, line 771)

Expected behavior

No Error

Affected versions

>= 26.0

Additional context

@maennchen maennchen added the bug Issue is reported as a bug label May 25, 2023
maennchen added a commit to maennchen/otp that referenced this issue May 25, 2023
Avoids crash when using verify_none and the OS does not have a CA cert bundle
@IngelaAndin IngelaAndin added the team:PS Assigned to OTP team PS label May 26, 2023
maennchen added a commit to maennchen/otp that referenced this issue May 26, 2023
Avoids crash when using verify_none and the OS does not have a CA cert bundle
maennchen added a commit to maennchen/otp that referenced this issue May 26, 2023
Avoids crash when using verify_none and the OS does not have a CA cert bundle
fhunleth added a commit to nerves-project/nerves_system_rpi3a that referenced this issue May 28, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
@dgud dgud closed this as completed May 29, 2023
fhunleth added a commit to nerves-project/nerves_system_rpi3a that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_rpi3a that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_rpi0 that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_rpi that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_bbb that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_rpi2 that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_rpi3 that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to fhunleth/nerves_system_npi_imx6ull that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_osd32mp1 that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_x86_64 that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_vultr that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to nerves-project/nerves_system_mangopi_mq_pro that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
fhunleth added a commit to smartrent/nerves_system_srhub that referenced this issue Jun 6, 2023
Erlang's httpc now looks for CA certifications in the normal system
location even with `:verify_none`. It looks like the `:verify_none`
issue will be fixed in [PR
7303](erlang/otp#7303), but it seems useful to
have a good set of certs there for httpc users.
rickard-green pushed a commit that referenced this issue Jun 8, 2023
…into maint-26

* dgud/inets/lazy-ssl-options/GH-7303/PR-7306/OTP-18604:
  Calculate httpc efault ssl options on demand (#7303)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Issue is reported as a bug team:PS Assigned to OTP team PS
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants