Added addition ssl options
Noah Zalev committed
May 2, 2021 at 15:30 UTC
2f5c5d9b03fdd395222185db70ee22d69b335b16
2 files changed
+10
-4
db.js
+6
-2
@@ -486,6 +486,7 @@ module.exports.CreateDB = function (parent, func) {
486
487
try {
488
if (connectinArgs.ssl) {
489
+ if (connectinArgs.ssl.dontcheckserveridentity == true) { connectionObject.ssl.checkServerIdentity = function(name, cert) { return undefined; } };
490
if (connectinArgs.ssl.cacertpath) { connectionObject.ssl.ca = [require('fs').readFileSync(connectinArgs.ssl.cacertpath, 'utf8')]; }
491
if (connectinArgs.ssl.clientcertpath) { connectionObject.ssl.cert = [require('fs').readFileSync(connectinArgs.ssl.clientcertpath, 'utf8')]; }
492
if (connectinArgs.ssl.clientkeypath) { connectionObject.ssl.key = [require('fs').readFileSync(connectinArgs.ssl.clientkeypath, 'utf8')]; }
@@ -1620,14 +1621,17 @@ module.exports.CreateDB = function (parent, func) {
1621
if (obj.databaseType == 4) {
1622
if (props.ssl) {
1623
sslOptions = ' --ssl';
1623
- if (props.ssl.cacertpath) sslOptions = ' --ssl-verify-server-cert --ssl-ca=' + props.ssl.cacertpath;
1624
+ if (props.ssl.cacertpath) sslOptions = ' --ssl-ca=' + props.ssl.cacertpath;
1625
+ if (props.ssl.dontcheckserveridentity != true) sslOptions += ' --ssl-verify-server-cert';
1626
if (props.ssl.clientcertpath) sslOptions += ' --ssl-cert=' + props.ssl.clientcertpath;
1627
if (props.ssl.clientkeypath) sslOptions += ' --ssl-key=' + props.ssl.clientkeypath;
1628
}
1629
} else {
1630
if (props.ssl) {
1631
sslOptions = ' --ssl-mode=required';
1630
- if (props.ssl.cacertpath) sslOptions = ' --ssl-mode=verify_identity --ssl-ca=' + props.ssl.cacertpath;
1632
+ if (props.ssl.cacertpath) sslOptions = ' --ssl-ca=' + props.ssl.cacertpath;
1633
+ if (props.ssl.dontcheckserveridentity != true) sslOptions += ' --ssl-mode=verify_identity';
1634
+ else sslOptions += ' --ssl-mode=required';
1635
if (props.ssl.clientcertpath) sslOptions += ' --ssl-cert=' + props.ssl.clientcertpath;
1636
if (props.ssl.clientkeypath) sslOptions += ' --ssl-key=' + props.ssl.clientkeypath;
1637
}
meshcentral-config-schema.json
+4
-2
@@ -28,7 +28,8 @@
28
"properties": {
29
"caCertPath": { "type": "string", "description": "Absolute path to the CA certificate. Required for self-signed certificates" },
30
"clientCertPath": { "type": "string", "description": "Absolute path to the client certificate. Required for two-way SSL Authentication" },
31
- "clientKeyPath": { "type": "string", "description": "Absolute path to the client key. Required for two-way SSL Authentication" }
31
+ "clientKeyPath": { "type": "string", "description": "Absolute path to the client key. Required for two-way SSL Authentication" },
32
+ "dontCheckServerIdentity": { "type": "boolean", "description": "Set true to not check the server hostname during verification" }
33
}
34
}
35
}
@@ -48,7 +49,8 @@
49
"properties": {
50
"caCertPath": { "type": "string", "description": "Absolute path to the CA certificate. Required for self-signed certificates" },
51
"clientCertPath": { "type": "string", "description": "Absolute path to the client certificate. Required for two-way SSL Authentication" },
51
- "clientKeyPath": { "type": "string", "description": "Absolute path to the client key. Required for two-way SSL Authentication" }
52
+ "clientKeyPath": { "type": "string", "description": "Absolute path to the client key. Required for two-way SSL Authentication" },
53
+ "dontCheckServerIdentity": { "type": "boolean", "description": "Set true to not check the server hostname during verification" }
54
}
55
}
56
}