How to disable ssl certificate verification in LazAutoUpdate
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
johnkirt · 2023-03-05 13:19

Hello, I want to use the LazAutoUpdate to update from a site with a
self-signed ssl certificate. Everything works over http, but nothing
works over https (only with a self-signed certificate). I Know that
using a self-signed certificate is not safe but I want to make it
work. After studying the source code of this module, I found the
function responsible for providing https
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i function
TFPCustomHTTPClient.GetSocketHandler(const UseSSL: Boolean):
TSocketHandler; begin  Result:=Nil;  if Assigned(FonGetSocketHandler)
then    FOnGetSocketHandler(Self,UseSSL,Result);  if (Result=Nil)
then  {$if not defined(HASAMIGA)}    If UseSSL then     
Result:=TSSLSocketHandler.Create    else  {$endif}     
Result:=TSocketHandler.Create;end; Full code:
http://svn.code.sf.net/p/lazarus-ccr/svn/components/lazautoupdate/late
st_stable/lazautoupdate_httpclient.pas

In turn, this function uses sslsockets (TSSLSocketHandler). Having
studied sslsockets source and tried different solutions, I could not
solve this problem. Is it possible to disable ssl certificate
verification to work with a server with a self-signed certificate?

----------------------------------------------------------------------
Thaddy · 2023-03-05 15:23

If your receiver certificate vault contains your certificate it should
work. You can add it manually.
Note that I have experience with that, but any certificate as such is
signed by my own CA as root.
Once you add the root certificate on the user side, everything should
be OK for any certificate which is signed by your root.
It needs to be installed specifically, though, and by hand. There is
no way around that.
Both on Windows and Unixes it requires elevated privilages. ( not
after the installation)

----------------------------------------------------------------------
johnkirt · 2023-03-05 16:18

I know If you add a certificate locally, it works, but I need it to
work regardless of whether it is added by a local CA or not. I have
encountered such a problem in C# and you can turn off ssl verification
there.

----------------------------------------------------------------------
Thaddy · 2023-03-05 16:36

Quote from: johnkirt on March 05, 2023, 05:18:31 pmI know If you add a
certificate locally, it works, but I need it to work regardless of
whether it is added by a local CA or not. I have encountered such a
problem in C# and you can turn off ssl verification there.
Only on developer level. On customer machines that should not be
possible. You are manipulating the truth. (and that is nicely written,
plain wrong)
You can not turn off ssl verification except locally, or finding a
victim that installs your certificate.....

----------------------------------------------------------------------
PierceNg · 2023-03-06 03:52

Quote from: johnkirt on March 05, 2023, 02:19:05 pmIn turn, this
function uses sslsockets (TSSLSocketHandler). Having studied
sslsockets source and tried different solutions, I could not solve
this problem. Is it possible to disable ssl certificate verification
to work with a server with a self-signed certificate?

TSSLSocketHandler has this property:

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i    
property VerifyPeerCert: Boolean read FVerifyPeerCert Write
FVerifyPeerCert; 
Try setting it to false. If that doesn't work, then the class also
has:

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i    
property RemoteHostName : String Index 2 read GetString write
SetString; deprecated 'use CertificateData instead';    property
Certificate : TSSLData Index 0 Read GetSSLData Write SetSSLData;
deprecated 'use CertificateData instead';    property
TrustedCertificate : TSSLData Index 1 Read GetSSLData Write
SetSSLData;deprecated 'use CertificateData instead';    property
PrivateKey : TSSLData Index 2 Read GetSSLData Write
SetSSLData;deprecated 'use CertificateData instead';    property PFX:
TSSLData Index 3 Read GetSSLData Write SetSSLData;deprecated 'use
CertificateData instead';    property CertCA: TSSLData Index 4 Read
GetSSLData Write SetSSLData;deprecated 'use CertificateData instead'; 
  property OnVerifyCertificate: TVerifyCertificateEvent read
FOnVerifyCertificate write FOnVerifyCertificate; 
Try setting the CertCA property to your self-signed / private CA cert.
Or implement a handler for the OnVerifyCertificate event.

One of these ought to do it.

----------------------------------------------------------------------
Thaddy · 2023-03-06 07:16

That will only work one sided. (It is about the peer certificate)
If you are on a fixed or reasonably stable IPv4/v6, you can obtain a
letsencrypt certificate for free.
That may solve your problem.
My home server is on a stable IP and works with letsencrypt. My other
servers are either static and http or work with a commercial
certificate (comodo).

But self-signed certificates are great for development, as are the
properties that Pierceng mentioned.
They are not meant for production code, though.
Self-signed certificates are also great for secure connections withinn
a lan/wan network over which you have full control. (where an
administrator controls all keyrings).
But in principle it is a bad idea to ignore certificates.
1.: Get one for free
2.: Create a CA and derived certificates. Make sure the other side
adds your CA public key to their Keyring.

----------------------------------------------------------------------
Thaddy · 2023-03-06 09:38

I did some tests. It seems that the suggestion by pierceng actually
works on the client level.
Tested against one of my own websites, which has a self-signed
certificate: https://thaddy.org
A browser would initialize refuse the connection with a 443 error, but
a small fphttpclient will succeed when VerifySSLCertificate := false
and fails when VerifySSLCertificate := true.
Code used is similar to my other post, but with exception handling.
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i {$mode
objfpc}uses  
classes,sysutils,fphttpclient,opensslsockets,fpJson,jsonparser; var 
Client:TFpHttpClient;  List:TStringList;  URL:String =
'https://thaddy.org';begin  Randomize;  Client :=
TfpHttpClient.Create(nil);  try    // this is important   
Client.AllowRedirect := true;     // optional   
Client.RequestHeaders.Add('User-Agent: Mozilla/5.0 (X11; Linux x86_64;
rv:12.0) Gecko/20100101 Firefox/12.0');    Client.VerifySSLCertificate
:= Boolean(random(2)); // fails or succeeds based on true/false   
List := TStringlist.Create;    try      try        List.Text :=
Client.Get(URL);        writeln(Client.ResponseStatusText,
Client.ResponseStatusCode: 5);      except         On          
 E:Exception do             writeln(E.Message);      end;     
writeln(List.Text);    finally      List.Free;    end;  finally   
Client.Free;  end;end.

Response can be (true): Code: [Select]Connect to thaddy.org:443
failed: SSL error code: 336134278: error:14090086:SSL
routines:ssl3_get_server_certificate:certificate verify failedOr
(false):Code: [Select]OK  200
<html>Apache is functioning normally</html>
Don't worry about security here: apache is configured to only serve
static pages.
(unless I am testing CGI delivered pages, but those pages are usually
not publicly known and shortlived. There is also no database running
on this one.)

Also note - logically - that if the client has the certificate
installed it will always succeed! Also tested on a different laptop.
The other way around seems to fail everytime, though (a small server,
still testing)
This is all as expected. Does that help?

----------------------------------------------------------------------
johnkirt · 2023-03-06 18:20

I try this solution and it does not find such a property
VerifySSLCertificate.
The goal is to make LazAutoUpdate work with self-signed certificates.
The module uses its own unit based on the fphttpclient -
lazautoupdate_httpclient. I have to refactor this module
(lazautoupdate_httpclient - https://svn.code.sf.net/p/lazarus-ccr/svn/
components/lazautoupdate/latest_stable/lazautoupdate_httpclient.pas)
or the place where this one is called in  (ulazautoupdate -
https://svn.code.sf.net/p/lazarus-
ccr/svn/components/lazautoupdate/latest_stable/ulazautoupdate.pas)? I
tried to add VerifySSLCertificate := false
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i procedure
TDownloadThreadClass.Execute;begin  fHTTPClient :=
TFPHTTPClient.Create(nil);  fHTTPClient.VerifySSLCertificate := false;
// ulazautoupdate.pas(2697,15) Error: identifier idents no member
"VerifySSLCertificate"  //
OnThreadDataEvent:=fHTTPClient.OnDataReceived;  //
fHTTPClient.OnDataReceived:=@DoPercent;  // Start the download
procedure  fDownloadSize := GetDownloadFileSize(fURL,
fIsRepositoryURL);  if (fDownloadSize > 0) then  begin   
fDownloadSize := 0;    DownloadHTTP(fURL, fFileName, fReturnCode,
fDownloadSize,      fIsRepositoryURL, fDebugMode);  end  else   
fLastError := 'Zero Size'; end;  in ulazautoupdate -
https://svn.code.sf.net/p/lazarus-
ccr/svn/components/lazautoupdate/latest_stable/ulazautoupdate.pas
but it does not find such a property VerifySSLCertificate.

----------------------------------------------------------------------
TRon · 2023-03-06 18:27

Quote from: johnkirt on March 06, 2023, 07:20:58 pmI try this solution
and it does not find such a property VerifySSLCertificate.
Try Free Pascal trunk.

----------------------------------------------------------------------
PierceNg · 2023-03-07 01:51

Quote from: johnkirt on March 06, 2023, 07:20:58 pmI try this solution
and it does not find such a property VerifySSLCertificate.

Thaddy is testing what I wrote using TFPHTTPClient. See my post
earlier the relevant properties of TSSLSocketHandler.

----------------------------------------------------------------------
johnkirt · 2023-03-07 16:23

I tried the properties you suggested and nothing helped.
Experimentally, I found out that the program stops at this point, that
is, it does not have time to apply this property yet.
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i function
TFPCustomHTTPClient.GetSocketHandler(const UseSSL: Boolean):
TSocketHandler;Var AHandler : TSSLSocketHandler;begin  Result:=Nil; 
AHandler:=Nil;  if Assigned(FonGetSocketHandler) then   
FOnGetSocketHandler(Self,UseSSL,Result);  if (Result=Nil) then  {$if
not defined(HASAMIGA)}    If UseSSL then    begin       
 ShowMessage('Before');         AHandler:= TSSLSocketHandler.Create;
//here the program stops         AHandler.VerifyPeerCert:=false;     
  ShowMessage('After');         Result:=AHandler;    end    else 
{$endif}      Result:=TSocketHandler.Create;end;