Mirrors/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden synced 2024-11-25 13:20:23 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add config to disable system root cert store

Browse source
This commit is contained in:
Josef Schönberger 2024-02-27 15:42:13 +01:00 committed by Mathijs van Veluw
parent d4e66d38b1
commit f0366d054f
3 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
.env.template
View file

@ -529,6 +529,9 @@
## Paths to PEM files, separated by semicolons
# SMTP_ADDITIONAL_ROOT_CERTS=
## Use system root certificate store for TLS host verification
# SMTP_USE_SYSTEM_ROOT_CERTS=true
##########################
### Rocket settings ###
##########################

2
src/config.rs
View file

@ -676,6 +676,8 @@ make_config! {
smtp_accept_invalid_hostnames: bool, true, def, false;
/// Accept additional root certs |> Paths to PEM files, separated by semicolons
smtp_additional_root_certs: String, true, option;
/// Use system root certificate store for TLS host verification
smtp_use_system_root_certs: bool, true, def, true;
},
/// Email 2FA Settings

5
src/mail.rs
View file

@ -7,7 +7,7 @@ use percent_encoding::{percent_encode, NON_ALPHANUMERIC};
use lettre::{
message::{Attachment, Body, Mailbox, Message, MultiPart, SinglePart},
transport::smtp::authentication::{Credentials, Mechanism as SmtpAuthMechanism},
transport::smtp::client::{Certificate, Tls, TlsParameters},
transport::smtp::client::{Certificate, CertificateStore, Tls, TlsParameters},
transport::smtp::extension::ClientId,
Address, AsyncSendmailTransport, AsyncSmtpTransport, AsyncTransport, Tokio1Executor,
};
@ -67,6 +67,9 @@ fn smtp_transport() -> AsyncSmtpTransport<Tokio1Executor> {
tls_parameters = tls_parameters.add_root_certificate(cert.clone());
}
}
if !CONFIG.smtp_use_system_root_certs() {
tls_parameters = tls_parameters.certificate_store(CertificateStore::None);
}
let tls_parameters = tls_parameters.build().unwrap();
if CONFIG.smtp_security() == *"force_tls" {