0

I'm writing an API which is running on my own web server written in Go. I have a local environment set up to run it all under HTTS using a self signed cert and it all works great. It all works and I can see that the traffic is indeed encrypted and it all looks good to me.

My questions is this though:

I'm trying to understand if there is any way for users/clients to "downgrade" or in some way force HTTP over HTTPS. When I test the HTTPS version by hitting an endpoint with a JSON payload using the "-k" flag in curl, it still seems to work and I get the correct response back from my API. So is this downgrading it in any way or is it just not verifying the certificate?

Note that when I try hitting the API with "http://..." rather than "https://..." it doesn't work at all, which is one of the reasons why I'm thinking about it just being certificate verification only.

Apologies if this questions seems rather basic... just looking to be sure and take no chances!

Cheers

1 Answer 1

2

The -k option with curl disables certificate verification for https connections, but it does not downgrade the connection from https to http.

This will allow your https connection to proceed, despite the fact that the server's self-signed certificate is not signed by a CA that curl recognizes. However, this also has the adverse effect of allowing a man-in-the-middle (MITM) attacker to use his own self-signed certificate to impersonate the server, and intercept the connection.

A better solution would be to add the certificate to the local trust store, so that curl recognizes it, or to use the --cacert option with curl to tell curl to trust the certificate.

See https://curl.se/docs/sslcerts.html for more info.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .