FreshRSS/FreshRSS

[BUG] SSL error even after disabling verification of SSL security

Open

#3,752 opened on Aug 8, 2021

View on GitHub
 (20 comments) (0 reactions) (0 assignees)PHP (1,171 forks)batch import
Good first issue 1️⃣Security :shield:help wanted

Repository metrics

Stars
 (15,022 stars)
PR merge metrics
 (Avg merge 11d 12h) (36 merged PRs in 30d)

Description

Describe the bug Some of my feeds use self-signed certificates. When I set "Verify SSL security" to "No" for these feeds individually, I am still not able to access the feeds via FreshRSS. I get the following error:

cURL error 59: failed setting cipher list: DEFAULT@SECLEVEL=1 [https://www.example.com]

To Reproduce Some of the feeds are on my own server using a self-certificate that I generated myself using the following:

openssl req -x509 -nodes -days 365 -newkey rsa:2048

The feed is password-protected so I set the correct username and password in FreshRSS, change "Verify SSL security" to "No," and I try to refresh the feed but it fails with the above error.

Expected behavior FreshRSS should disregard any SSL errors and fetch the feed.

Environment information (please complete the following information):

  • OS: OpenBSD 6.9
  • Browser: Firefox 90.0.2
  • FreshRSS version: 1.18.1
  • Database version: PostgreSQL 13.2
  • PHP version: PHP 8.0.9
  • Installation type: Self-hosted server

Additional context

  • PHP-FPM runs in a chrooted environment by default in OpenBSD. This led to some php-curl errors for me until I figured out that I need to copy /etc/resolv.conf and /etc/ssl/ to the chroot, but I doubt that this is still related to the issue.
  • These feeds updated fine in another RSS reader that I was using previously when I enabled the option to ignore self-signed certificates.
  • I saw the issues that seem somewhat related like #3029 but I would like to avoid making these security changes global as a workaround. I just want to disable SSL error checking for specific feeds so that the validity of other feeds is still checked.

Contributor guide