No validation of leaf certificate
Closed this issue · 3 comments
Guillembonet commented
Hey, I believe that your code is not validating the first certificate in the chain and therefore anyone can send a fake server-to-server notification and get validated. See more details in the comment I left in stackoverflow.
Happy to provide more info if needed!
richzw commented
Yes, you are right. To ensure the integrity of the certificate chain, it is necessary to verify the leaf certificate. I overlooked this point at the time. I could fix it later, or welcome to submit your PR. @Guillembonet
Guillembonet commented
@richzw okay yeah, leave it for me I will PR later. Always nice to contribute to opensource!
Guillembonet commented
There you go @richzw