GalaFructose
Cadet
- Joined
- Oct 28, 2023
- Messages
- 1
The SSL X509 certificate handling in TrueNAS does not check the CN= against the FQDN that the user configured, and as such there is no indication that the certificate that TrueNAS receives from a SSL-based server actually belongs to the server in question, when sending out email reports.
This could allow a malicious person to redirect (via DNS manipulation or otherwise) a user to a different server than intended and, using a valid server certificate from any host, permit the connection to succeed normally with no indication to the user that the certificate is invalid for the specified server.
Ideally, TrueNAS would do this check, but also have a checkbox to ignore such invalid hostname/SSL errors.
This could allow a malicious person to redirect (via DNS manipulation or otherwise) a user to a different server than intended and, using a valid server certificate from any host, permit the connection to succeed normally with no indication to the user that the certificate is invalid for the specified server.
Ideally, TrueNAS would do this check, but also have a checkbox to ignore such invalid hostname/SSL errors.
