[GH-ISSUE #640] unclear if certs validation is occuring? #364

New issue

Closed

opened 2026-03-04 01:44:47 +03:00 by kerem · 2 comments

kerem commented

2026-03-04 01:44:47 +03:00

Owner

Originally created by @quadgnim on GitHub (Sep 14, 2017).
Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/640

I noticed in https://github.com/s3fs-fuse/s3fs-fuse/blob/master/src/s3fs.cpp, line 4938 indicates the cert validation logic is commented out. Can anyone verify if this is being done elsewhere, and if not, why is it commented out, is there a problem with it? to protect from man in the middle attacks, we'd very much like to see cert validation against the s3 endpoint ocuring. Is this in the plans to enable soon?

Originally created by @quadgnim on GitHub (Sep 14, 2017). Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/640 I noticed in https://github.com/s3fs-fuse/s3fs-fuse/blob/master/src/s3fs.cpp, line 4938 indicates the cert validation logic is commented out. Can anyone verify if this is being done elsewhere, and if not, why is it commented out, is there a problem with it? to protect from man in the middle attacks, we'd very much like to see cert validation against the s3 endpoint ocuring. Is this in the plans to enable soon?

kerem closed this issue

2026-03-04 01:44:47 +03:00

kerem commented

2026-03-04 01:44:48 +03:00

Author

Owner

@ggtakec commented on GitHub (Sep 17, 2017):

@quadgnim
This comment is outdated.
(We will delete comments at a later date.)

By default we are checking with CURLOPT_SSL_VERIFYHOST.
https://github.com/s3fs-fuse/s3fs-fuse/blob/master/src/curl.cpp#L1589

If you do not want to check, please specify ssl_verify_hostname = 0.

Currently, even if "." (Period) is included in the bucket name, it will work if you set use_path_request_style.
https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ#q-https-connecting-failed-if-bucket-name-includes-dod

@ggtakec commented on GitHub (Sep 17, 2017): @quadgnim This comment is outdated. (We will delete comments at a later date.) By default we are checking with CURLOPT_SSL_VERIFYHOST. https://github.com/s3fs-fuse/s3fs-fuse/blob/master/src/curl.cpp#L1589 If you do not want to check, please specify ssl_verify_hostname = 0. Currently, even if "." (Period) is included in the bucket name, it will work if you set use_path_request_style. https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ#q-https-connecting-failed-if-bucket-name-includes-dod

kerem commented

2026-03-04 01:44:48 +03:00

Author

Owner

@gaul commented on GitHub (Mar 15, 2019):

As demonstrated by S3Proxy unit tests, SSL validation occurs and we specifically need to disable it for this self-signed certificate. Please reopen if I misunderstand this issue.

@gaul commented on GitHub (Mar 15, 2019): As demonstrated by S3Proxy unit tests, SSL validation occurs and we specifically need to disable it for this self-signed certificate. Please reopen if I misunderstand this issue.

kerem referenced this issue

2026-03-04 01:54:11 +03:00

[PR #364] [MERGED] Checked content-type by no case-sensitivity - #363 #1483