FreshRSS/FreshRSS

[BUG] SSL error even after disabling verification of SSL security

Open

#3,752 建立於 2021年8月8日

在 GitHub 查看
 (20 留言) (0 反應) (0 負責人)PHP (1,171 fork)batch import
Good first issue 1️⃣Security :shield:help wanted

倉庫指標

Star
 (15,022 star)
PR 合併指標
 (平均合併 11天 12小時) (30 天內合併 36 個 PR)

描述

Describe the bug Some of my feeds use self-signed certificates. When I set "Verify SSL security" to "No" for these feeds individually, I am still not able to access the feeds via FreshRSS. I get the following error:

cURL error 59: failed setting cipher list: DEFAULT@SECLEVEL=1 [https://www.example.com]

To Reproduce Some of the feeds are on my own server using a self-certificate that I generated myself using the following:

openssl req -x509 -nodes -days 365 -newkey rsa:2048

The feed is password-protected so I set the correct username and password in FreshRSS, change "Verify SSL security" to "No," and I try to refresh the feed but it fails with the above error.

Expected behavior FreshRSS should disregard any SSL errors and fetch the feed.

Environment information (please complete the following information):

  • OS: OpenBSD 6.9
  • Browser: Firefox 90.0.2
  • FreshRSS version: 1.18.1
  • Database version: PostgreSQL 13.2
  • PHP version: PHP 8.0.9
  • Installation type: Self-hosted server

Additional context

  • PHP-FPM runs in a chrooted environment by default in OpenBSD. This led to some php-curl errors for me until I figured out that I need to copy /etc/resolv.conf and /etc/ssl/ to the chroot, but I doubt that this is still related to the issue.
  • These feeds updated fine in another RSS reader that I was using previously when I enabled the option to ignore self-signed certificates.
  • I saw the issues that seem somewhat related like #3029 but I would like to avoid making these security changes global as a workaround. I just want to disable SSL error checking for specific feeds so that the validity of other feeds is still checked.

貢獻者指南