From 77e01d499550a1109cb18dbdf601d070b8fc2124 Mon Sep 17 00:00:00 2001
From: Pratik Mankawde <3397372+pratikmankawde@users.noreply.github.com>
Date: Thu, 6 Aug 2026 13:41:08 +0100
Subject: [PATCH] fix(telemetry): enable TLS verification for Mainnet validator
 list fetches

The Mainnet telemetry config carried ssl_verify=0, inherited when the file
was copied from the Devnet config. Mainnet fetches its validator lists from
public HTTPS publishers (vl.ripple.com, unl.xrplf.org) that present valid CA
certificates, so there is no self-signed certificate to work around.

With ssl_verify=0 both halves of TLS peer authentication are skipped on those
fetches: the certificate chain check and the RFC 6125 hostname match. The list
blob's own signature is still verified against the pinned publisher keys, so
this restores defense in depth rather than fixing a validator-injection path.

Restores the secure default and documents why it stays that way.
---
 docker/telemetry/xrpld-telemetry-mainnet.cfg | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/docker/telemetry/xrpld-telemetry-mainnet.cfg b/docker/telemetry/xrpld-telemetry-mainnet.cfg
index afca57e4fa..9bd8779483 100644
--- a/docker/telemetry/xrpld-telemetry-mainnet.cfg
+++ b/docker/telemetry/xrpld-telemetry-mainnet.cfg
@@ -105,8 +105,15 @@ data/logs/mainnet/debug.log
 
 # --- SSL --------------------------------------------------------------------
 
+# Keep the secure default (1). The Mainnet validator lists in
+# validators-mainnet.txt are fetched from public HTTPS publishers that present
+# valid CA certificates, so there is no self-signed cert to work around here.
+# Setting this to 0 would skip both the certificate chain check and the
+# hostname match on those fetches. The list blob's own signature is verified
+# against the pinned publisher keys either way; this adds TLS peer
+# authentication on top of that.
 [ssl_verify]
-0
+1
 
 # --- Insight (native OTel metrics via beast::insight) -----------------------