diff options
| -rw-r--r-- | data/default_config.cfg | 9 | ||||
| -rw-r--r-- | doc/en/configure.txt | 8 | ||||
| -rw-r--r-- | src/connection.py | 1 |
3 files changed, 17 insertions, 1 deletions
diff --git a/data/default_config.cfg b/data/default_config.cfg index ac2e245e..5232eb06 100644 --- a/data/default_config.cfg +++ b/data/default_config.cfg @@ -14,11 +14,18 @@ port = 5222 # Do not touch this if you don’t know what you are doing certificate = -# Skip the SSL verification +# Skip the SSL certificate fingerprint verification # Should be true in most cases, as you want to check that the server keeps # the same certificate. ignore_certificate = false +# Path to the certificate authenticating the Authority +# A server may have several certificates, but if it uses a CA, it will often +# keep the same for obvious reasons, so this is a good option if your server +# does this, rather than skipping all verifications. +# This is not affected by ignore_certificate +ca_cert_path = + # Auto-reconnects you when you get disconnected from the server # defaults to false because it should not be necessary auto_reconnect = false diff --git a/doc/en/configure.txt b/doc/en/configure.txt index 4f69084e..b8ea04cb 100644 --- a/doc/en/configure.txt +++ b/doc/en/configure.txt @@ -59,6 +59,14 @@ section of this documentation. anonymous mode and changing servers often. Dangerous in other cases, from a security perspective. +*ca_cert_path*:: [empty] + + Path to the certificate of the Certification Authority. + As some services may keep different certificates, it is an alternative to + the Trust On First Use model provided by _certificate_. This option is not + affected by _ignore_certificate_ and boths checks may be active at the same + time. + *resource*:: [empty] the resource you will use diff --git a/src/connection.py b/src/connection.py index 8a7c1ea7..0e92755f 100644 --- a/src/connection.py +++ b/src/connection.py @@ -44,6 +44,7 @@ class Connection(sleekxmpp.ClientXMPP): self.core = None self.auto_reconnect = True if config.get('auto_reconnect', 'false').lower() in ('true', '1') else False self.auto_authorize = None + self.ca_certs = config.get('ca_cert_path', '') or None self.register_plugin('xep_0030') self.register_plugin('xep_0004') self.register_plugin('xep_0045') |