#265 optional ssl params, wip on rejectUnauthorized

[apietroni51]

No description provided.

[apietroni51]

@tarzacodes @icappello @albertobarrila
we have made the SSL params optional reflecting tls.connect() but we're not sure what to do with rejectUnauthorized, which was currently overridden to false. What should we do with it?

[albertobarrila]

@apietroni51 for the rejectUnauthorized that now is sculpted in, the right place imho is inside the SSL configuration

[tarzacodes]

@tarzacodes @icappello @albertobarrila we have made the SSL params optional reflecting tls.connect() but we're not sure what to do with rejectUnauthorized, which was currently overridden to false. What should we do with it?

I don't remember ever implementing code that tried to validate the server's identity using the SSL data - if we can't (or simply currently aren't) we need to set rejectUnauthorized as false - you can't ask us (the client) to do that because we don't know how

EDIT: Node does that natively apparently -
https://stackoverflow.com/questions/31861109/tls-what-exactly-does-rejectunauthorized-mean-for-me
We use tls.connect at line 137 in connection.ts so rejecting unrecognized/unauthorized agents is very doable without having to write a ton of code. My bad!