Repository navigation
Validate the server certificate by default #263
Description
Problem
skipTlsValidation defaults to true (see Connecting). A client connecting to a shared or production server therefore accepts any certificate for both gRPC calls and token requests unless the connection string sets skipTlsValidation=false. Anyone who can intercept the connection can read the credentials and the events. A safe connection should not depend on every user remembering that option.
Proposal
- Validate the server certificate by default.
- Keep the local development image easy to use through an explicit opt-out (for example
skipTlsValidation=truedocumented for local use, or detection of the development setup). - Consider an option for a custom certificate authority bundle; today the certificate must be trusted by the default Node.js and gRPC trust store.
This is likely a breaking change for clients that rely on the current default against self-signed servers.
Done when
- A new connection validates the server certificate unless told not to.
- The documentation explains how to connect to the development image.
Status
State: Backlog — not being worked on. The first step shipped in v6.54.0 (#266): the client warns at connection start when certificate validation is skipped against a non-loopback host, and the documentation explains the setting.
Remaining: Validate the server certificate by default. This is a breaking change for the next major version, and it needs coordination with the .NET client's default.
Activity
woksin commentedon Oct 29, 2026
Analysis and proposed solution
skipTlsValidationistrueunless the connection string setsskipTlsValidation=false: ChronicleConnectionString.ts#L245-L248.rejectUnauthorized: false: ChronicleConnectionString.ts#L569-L576.localhost,127.0.0.1or::1, log one warning at connection start. The warning names the host and says how to enable validation (skipTlsValidation=false). It covers the gRPC channel and the OAuth token fetch.skipTlsValidation=falseor fordisableTls; the warning appears once per connection, not per call.skipTlsValidation=true, or by trusting the development certificate. This needs woksin's approval as a breaking change.