[SOLVED] TLS client without any server verification

TLS client without any server verification

I'm writing a Toit program that needs to connect to a TLS server in my local network. The server is only able to handle TLS connections but because of the local network I don't need any verification.

Is there a way to disable the TLS verification?

Solution

Toit doesn't provide any way of disabling TLS verification.

However, it's pretty easy to accept the certificate of your local server, even if it wasn't signed by a known certificate authority.

Start by getting the certificate of the local server. You can use Chrome, or simply openssl:

openssl s_client -connect <YOUR-MACHINE>

Take the certificate (typically starting with -----BEGIN CERTIFICATE-----) and store it in your Toit application:

CERTIFICATE ::= """
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

You can then install this certificate as follows:

import tls

CERT ::= """
...
"""

main:
  my-root := tls.RootCertificate CERT
  my-root.install
  // TLS connections to your server should now succeed.