ARCHIVE/rippled
1
0
Fork 0
mirror of https://github.com/XRPLF/rippled.git synced 2026-08-21 06:10:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(telemetry): enable TLS verification for Mainnet validator list fetches

Browse Source 
The Mainnet telemetry config carried ssl_verify=0, inherited when the file
was copied from the Devnet config. Mainnet fetches its validator lists from
public HTTPS publishers (vl.ripple.com, unl.xrplf.org) that present valid CA
certificates, so there is no self-signed certificate to work around.

With ssl_verify=0 both halves of TLS peer authentication are skipped on those
fetches: the certificate chain check and the RFC 6125 hostname match. The list
blob's own signature is still verified against the pinned publisher keys, so
this restores defense in depth rather than fixing a validator-injection path.

Restores the secure default and documents why it stays that way.
This commit is contained in:
Pratik Mankawde
2026-08-06 13:41:08 +01:00
parent 761c4e2872
commit 77e01d4995
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docker/telemetry/xrpld-telemetry-mainnet.cfg
View File

@@ -105,8 +105,15 @@ data/logs/mainnet/debug.log
# --- SSL --------------------------------------------------------------------
# Keep the secure default (1). The Mainnet validator lists in
# validators-mainnet.txt are fetched from public HTTPS publishers that present
# valid CA certificates, so there is no self-signed cert to work around here.
# Setting this to 0 would skip both the certificate chain check and the
# hostname match on those fetches. The list blob's own signature is verified
# against the pinned publisher keys either way; this adds TLS peer
# authentication on top of that.
[ssl_verify]
0
1
# --- Insight (native OTel metrics via beast::insight) -----------------------