cloudflare / cloudflare/workerd

Feature Request: Allow arbitrary unauthorized self-signed certificates

Open
#6,586 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.7k
Forks
739
Avg merge
2d 20h
Merged PRs (30d)
174

Description

> This is a copy of https://github.com/cloudflare/workers-sdk/discussions/13489, which I originally opened on the workers-sdk repo.

Hi there! Not sure if this should be a bug or a feature request, but here's my need:

I'm trying to build a Gemini proxy (an HTTP proxy for the Gemini protocol).
More info about Gemini is here: https://geminiprotocol.net, but it's similar to Gopher, and I've been able to use the same sample code for Gopher (in the TCP documentation) with little changes.

The main difference between them however is that Gemini enforces the use of TLS, but not through CAs, but instead through self-signed certificates (on the server-side). This means that building a proxy requires that I accept _any_ valid certificate, without checking it against a CA.

Yes, that allows MITM attacks and such, but this is the way Gemini is designed.
For now, I get this error:
```
✘ [ERROR] workerd/jsg/util.c++:276: error: e = kj/compat/tls.c++:221: failed: TLS peer's certificate is not trusted; reason = self signed certificate
```
But I can't seem to find a way to basically skip certificate checks. In Node.js this can be done using the `NODE_TLS_REJECT_UNAUTHORIZED=0` env var, but it doesn't work in Workers.

Thanks in advance.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.