CODEWITHSUNDEEP
c++qtsslwebsocketqtwebsockets
madduci
madduci

Reputation: 2893

Best practices to check SSL Certificate validity on client side in QWebSockets

I'm trying to write an application which uses the brand new QWebSockets.

So far, I want to implement the secure web socket, but the examples point me to reject SSL errors, even if they have commented that it is unsafe.

My question is: how should I handle the controls on SSL certificates, even self-signed ones, on client side? What are the best practices in this case?

FYI, here there's a link to QSSLErrors which are emitted by the QWebSocket class .

Unfortunately, webSocket.sslConfiguration().peerCertificate() returns empty values when I'm printing them out.

Upvotes: 1

Views: 795

Answers (1)

user207421
user207421

Reputation: 310957

Very broad, but you shouldn't trust all certificates, or bypass hostname checking in HTTPS. You don't need to verify the certificate itself, as the library should do that. You should also check that the subjectDN of the certificate is the one you're expecting to see, unless you're using HTTPS which does that for you (hostname check).

Upvotes: 0

Related Questions