mirror of
https://github.com/XRPLF/rippled.git
synced 2026-08-21 14:20:56 +00:00
77e01d4995
The Mainnet telemetry config carried ssl_verify=0, inherited when the file was copied from the Devnet config. Mainnet fetches its validator lists from public HTTPS publishers (vl.ripple.com, unl.xrplf.org) that present valid CA certificates, so there is no self-signed certificate to work around. With ssl_verify=0 both halves of TLS peer authentication are skipped on those fetches: the certificate chain check and the RFC 6125 hostname match. The list blob's own signature is still verified against the pinned publisher keys, so this restores defense in depth rather than fixing a validator-injection path. Restores the secure default and documents why it stays that way.