Best way to disable cert validation for certain domains only

[theS1LV3R]

Hi!

If I had a list of domains or wildcards or similar (e.g. ["*.onion", "*.home.arpa"] etc) what would be the best way to only disable validation for these specific domains?

For ClientBuilder there exists the option tls_danger_accept_invalid_certs which can globally enable or disable certificate validation for the entire client, but this is not what I am looking for as I want to keep validation enabled for requests not matching the configured hosts.

I've seen I can use tls_backend_preconfigured to pass in an entire rustls backend which I assume could fix this, but that seems like overkill when I only need to disable validation for some domains? That could also quickly lead to security issues if i only check the SAN on the host itelf, and a mitm attacker serves a certificate for a SAN host we ignore but that we're supposed to validate. ServerCertVerifier from rustls provides server_name in the verify_server_cert method, so I could use that to determine if certs should be verified. There is however still no easy way to pass a custom validator into reqwest, which would be the ideal solution i think

[darekwojciechowski]

There's no per-host hook, tls_danger_accept_invalid_certs is the only knob and it's client-wide.

Easiest way out is two clients and picking one per request:

let strict = reqwest::Client::new();
let lax = reqwest::Client::builder()
    .tls_danger_accept_invalid_certs(true)
    .build()?;

let host = url.host_str().unwrap_or_default();
let client = if is_exempt(host) { &lax } else { &strict };

They keep separate connection pools, so a connection opened without validation can't be reused for a host you do validate. With a single client and a custom verifier that's on you to think about.

The verifier route works too, and your read of it is right: server_name is what the client asked for, not what the certificate claims, so matching on it is safe. Wrap WebPkiServerVerifier, return ServerCertVerified::assertion() for your exempt names, delegate everything else (including verify_tls12_signature and verify_tls13_signature), then pass the ClientConfig to tls_backend_preconfigured.

One thing to know before you do: that method takes impl Any and has no semver guarantees, so your rustls version has to match the one reqwest was built against. Mismatch gives you an "Unknown TLS backend" error at build(), not a compile error.

[theS1LV3R]

For my usecase I believe a verifier route will work best. Is there any way to (or plans for ways to) directly pass in a validator without a whole preconfigured backend? From my short looking at the code reqwest sets a good amount of defaults it would be nice to continue using, since we don't need to change any of those options.