FreshRSS / FreshRSS/FreshRSS

[BUG] SSL error even after disabling verification of SSL security

Open
#3,752 20 comments 0 reactions 0 assignees View on GitHub
Good first issue 1️⃣ help wanted Security :shield:
Dominant language
PHP
Stars
16k
Forks
1.3k
Avg merge
13h 24m
Merged PRs (30d)
40

Description

**Describe the bug**
Some of my feeds use self-signed certificates. When I set "Verify SSL security" to "No" for these feeds individually, I am still not able to access the feeds via FreshRSS. I get the following error:

```
cURL error 59: failed setting cipher list: DEFAULT@SECLEVEL=1 [https://www.example.com]
```

**To Reproduce**
Some of the feeds are on my own server using a self-certificate that I generated myself using the following:

```
openssl req -x509 -nodes -days 365 -newkey rsa:2048
```

The feed is password-protected so I set the correct username and password in FreshRSS, change "Verify SSL security" to "No," and I try to refresh the feed but it fails with the above error.

**Expected behavior**
FreshRSS should disregard any SSL errors and fetch the feed.

**Environment information (please complete the following information):**
- OS: OpenBSD 6.9
- Browser: Firefox 90.0.2
- FreshRSS version: 1.18.1
- Database version: PostgreSQL 13.2
- PHP version: PHP 8.0.9
- Installation type: Self-hosted server

**Additional context**
- PHP-FPM runs in a chrooted environment by default in OpenBSD. This led to some php-curl errors for me until I figured out that I need to copy `/etc/resolv.conf` and `/etc/ssl/` to the chroot, but I doubt that this is still related to the issue.
- These feeds updated fine in another RSS reader that I was using previously when I enabled the option to ignore self-signed certificates.
- I saw the issues that seem somewhat related like #3029 but I would like to avoid making these security changes global as a workaround. I just want to disable SSL error checking for specific feeds so that the validity of other feeds is still checked.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.