Default Value of fail_if_no_peer_cert about emqx HOT 10 OPEN

@zmstone I don't think so, the default value of this option in the configuration file is also false.

We can change default value from backend, but frontend is independent implementation.

from emqx.

Here is my proposal.
In 5.8, we will only expose "verify peer" option in config and in dashboard, always force client to send certificate when "verify_peer".
For backward compatibility, we will hide fail_if_no_peer_cert from backend schema.

from emqx.

Here is my proposal. In 5.8, we will only expose "verify peer" option in config and in dashboard, always force client to send certificate when "verify_peer". For backward compatibility, we will hide fail_if_no_peer_cert from backend schema.

emmm What happens to listeners that had fail_if_no_peer_cert set to false?

it will be discarded

from emqx.

@ysfscream this is more of a frontend enhancement?

from emqx.

Why do we even have this option? Is there a scenario when a user may want to allow plain tcp connection on SSL port?

from emqx.

@zmstone I don't think so, the default value of this option in the configuration file is also false.

from emqx.

Why do we even have this option? Is there a scenario when a user may want to allow plain tcp connection on SSL port?

Good point.

from emqx.

@id When fail_if_no_peer_cert is false, the client still establishes a TLS connection to the server, it just won't be asked for a client certificate.

The only scenario I can think of is that all the user's clients access from the same TLS port, some of them provide client certificates for two-way authentication, and these clients will skip the password authentication of EMQX. The other part does not provide client certificates, after establishing a TLS connection, they must pass password authentication to actually access EMQX.

However, I think only HTTP authentication currently supports this process.

from emqx.

Here is my proposal. In 5.8, we will only expose "verify peer" option in config and in dashboard, always force client to send certificate when "verify_peer". For backward compatibility, we will hide fail_if_no_peer_cert from backend schema.

emmm What happens to listeners that had fail_if_no_peer_cert set to false?

from emqx.

Why do we even have this option? Is there a scenario when a user may want to allow plain tcp connection on SSL port?

Peer sending its cert is sometimes optional for TLS client (not limited to MQTT).

from emqx.