TLS_CONFIG_VERIFY(3)

💖 TLS_CONFIG_VERIFY(3) — the insecure TLS config era 💖

okay bestie, so this is the tls_config_verify(3) page from the Library Functions Manual, and it's giving "here be dragons" energy fr fr. Buckle up 🎀

✨ NAME ✨

tls_config_verify, tls_config_insecure_noverifycert, tls_config_insecure_noverifyname, tls_config_insecure_noverifytime — insecure TLS configuration 👀

🦋 SYNOPSIS 🦋

#include <tls.h>

void
tls_config_verify(struct tls_config *config);

void
tls_config_insecure_noverifycert(struct tls_config *config);

void
tls_config_insecure_noverifyname(struct tls_config *config);

void
tls_config_insecure_noverifytime(struct tls_config *config);

🌸 DESCRIPTION 🌸

So these functions turn OFF parts of the normal certificate verification process, which means the resulting configs are insecure. Like, genuinely. The manpage itself says be very careful when using them, and honestly bestie, listen to the manpage for once 😭

• tls_config_insecure_noverifycert() — turns off certificate verification and OCSP validation. Both. Gone. 💀
• tls_config_insecure_noverifyname() — turns off server name verification. This one's client only, iykyk.
• tls_config_insecure_noverifytime() — turns off validity checking of certificates and OCSP validation. Time is fake, apparently ⏰
• tls_config_verify() — the glow-up function ✨ reenables server name verification and certificate verification. We love a redemption arc.

bestie I'm so serious: these disable real security checks. Use them only when you know exactly why, not just because the error message was annoying. 🙈

👑 SEE ALSO 👑

tls_client(3), tls_config_ocsp_require_stapling(3), tls_config_set_protocols(3), tls_conn_version(3), tls_connect(3), tls_handshake(3), tls_init(3)

🌈 HISTORY 🌈

• tls_config_verify() appeared in OpenBSD 5.6 and got its final name in OpenBSD 5.7. character development 🫶
• tls_config_insecure_noverifycert() and tls_config_insecure_noverifyname() appeared in OpenBSD 5.7, and tls_config_insecure_noverifytime` showed up in **OpenBSD 5.9.

⭐ AUTHORS ⭐

• Joel Sing <jsing@openbsd.org>
• Ted Unangst <tedu@openbsd.org>

and that's the whole page, bestie — sending you off with the deets: this one's the Debian build, dated March 2, 2017, filed under TLS_CONFIG_VERIFY(3). mwah 💅💖