1

I have a desktop app that syncs with a database at http://XXX.XXX.XX.XX:5984. I've enabled all server side security I available to me and I want to also set the desktop app to sync via SSL https://XXX.XXX.XX.XX:6984 so that if a user has the app on their laptop and is syncing using a public connection, their data is encrypted.

I set it up with a self signed certificate on the server and tested on the command line with the following but I get this notice:

curl https://XXX.XX.XX.XXX:6984

More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Since I'm the owner of the server and it's a direct ip to a port. Will turning off the verification of the cert (curl -k https://XXX.XX.XX.XXX:6984) mean my data will be sent unencrypted?

Improve this question
1
  • No. It just means that the encryption can be MITMed so the data privacy may be compromised. – sandyp Aug 17 '16 at 1:31
1

Turning off the verification will not mean that the data is sent unencrypted. The data will still be sent over HTTPS (an SSL/TLS connection), but the validity of the certificate from the server will not be verified with the certificate authority that issued the certificate.

In your case, because you signed the certificate yourself, you should indeed disable the verification check. Your certificate cannot be validated/verified by an issuing certificate authority, because your certificate is not issued by a certificate authority. Ergo, you should disable the verification check. The data will still be sent encrypted, but this does of course present some security concerns, because a clever MiTM attacker could introduce a bogus certificate for the client to use. As such, I would recommend getting a certificate issued from a CA, but if you want to stick with your self-signed ticket, then just disable the verification check.

Improve this answer
2
  • 4
    Getting a certificate signed by a CA is unnecessary, because of how it's intended to be used: distributed with an app. This is certificate pinning. You only need to verify against a CA to make sure one you receive from an unknown source matches the expected source. If you have a trusted source for the certificate (like you self-signed one), you're somewhat expected to turn off the validation. In the case of curl, I'd probably supply a custom bundle file. – Clockwork-Muse Aug 17 '16 at 2:17
  • @Clockwork-Muse, yes, you present a good point. If the certificate is distributed along with the application, then getting it issued by a CA is unnecessary. I was thinking about the case where the certificate is downloaded from the server at the time of the request (which could be attacked by a MiTM). However, quite right, if the certificate is distributed along with the application, then the OP should be fine, and he/she should be protected from a MiTM attack. – Spencer D Aug 17 '16 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.