I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default.
What are obvious attack vectors for MITMing a server-to-server HTTPS communication that accepts untrusted SSL certs?
Eg, DNS cache poisoning could be used to replace the real endpoint with an attacker's replacement that uses a self-signed cert.
As @steffen-ullrich mentioned, someone could rent a server in the same datacenter and try ARP spoofing.
Are there others?