Skip to content

Commit

Permalink
simplify ServerName validation
Browse files Browse the repository at this point in the history
Signed-off-by: Dmitry S <dsavints@gmail.com>
  • Loading branch information
dmitris committed Jul 10, 2023
1 parent b0185e8 commit 1b29097
Showing 1 changed file with 1 addition and 17 deletions.
18 changes: 1 addition & 17 deletions internal/pkg/cosign/tsa/client/client.go
Original file line number Diff line number Diff line change
Expand Up @@ -110,23 +110,7 @@ func getHTTPTransport(cacertFilename, certFilename, keyFilename, serverName stri
}

if serverName != "" {
// copied from https://pkg.go.dev/crypto/tls#example-Config-VerifyConnection,
// changed the DNSName setting from cs.Servername to serverName
tr.TLSClientConfig.InsecureSkipVerify = true
tr.TLSClientConfig.VerifyConnection = func(cs tls.ConnectionState) error {
opts := x509.VerifyOptions{
DNSName: serverName,
Intermediates: x509.NewCertPool(),
Roots: pool,
KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
}
for _, cert := range cs.PeerCertificates[1:] {
opts.Intermediates.AddCert(cert)
}

_, err := cs.PeerCertificates[0].Verify(opts)
return err
}
tr.TLSClientConfig.ServerName = serverName
}
return tr, nil
}
Expand Down

0 comments on commit 1b29097

Please sign in to comment.