option to turn off CURLOPT_SSL_VERIFYPEER from GUI for Moodle SSO with self-signed certs

[Matt Oquist]

Hi,

I have a Moodle+Mahara pair running on a box with a cert that looks invalid to curl. SSO works fine if I add CURLOPT_SSL_VERIFYPEER=>false to api/xmlrpc/client.php and api/xmlrpc/lib.php. It would be very nice if there were a configuration checkbox in the peers configuration screen(s) to tell Mahara not to worry about the peer's SSL certificate.

I'm not sure how this suggestion will be received, so I haven't bothered trying to write it and submit patches. I'd be happy to give that a go sometime if you're interested.

Cheers,
Matt

[Nigel-catalyst (nigel-catalyst)]

I was reasonably sure this is a duplicate feature request, but I can't find the other one.

I'm not convinced this should be a checkbox, but rather should be something you set in config.php. The reason for this is that the last thing you really want when setting up a trust relationship with a remote site, is to have a clueless admin check the "I don't care how insecure they are" box while trying to make it work. I can just see far more people checking the box than for whom it's actually needed.

At least if the system admin can set it in config.php, it requires a bit more thought - and on average, someone more likely to understand the risks.

Alternatively, maybe it could end up in the UI somehow - but with dire warnings when it's switched on, similar to how firefox and newer browsers do it.

[Matt Oquist (moquist)]

Sorry...I didn't do my homework and search first, I confess. (But if you couldn't find it, either, then I don't feel too bad. :)

+1 to the idea of a config.php option. I think that's a much better idea than putting it in the UI. Plus that's far simpler -- just a couple very small branches.

Cheers,
Matt