Tighten up the TLS requirements for server links.

Servers must now either provide a fingerprint in the link config or provide a
valid certificate. There's an undocumented (for now) opt-out in the config but
even with this set it still doesn't allow expired, revoked, or otherwise invalid
certificates.

1 files changed, 1 insertions, 0 deletions

diff --git a/modules/spanningtree/utils.cpp b/modules/spanningtree/utils.cpp
index 22b1a7a6a..797d711b2 100644
--- a/modules/spanningtree/utils.cpp
+++ b/modules/spanningtree/utils.cpp
@@ -285,6 +285,7 @@ void SpanningTreeUtilities::ReadConfiguration(ConfigStatus& status)
 		L->HiddenFromStats = tag->getBool("statshidden");
 		L->Timeout = tag->getDuration("timeout", 30);
 		L->Hook = tag->getString("sslprofile");
+		L->AllowSelfSigned = tag->getBool("allowselfsigned", !L->Fingerprint.empty());
 		L->Bind = tag->getString("bind");
 		L->Hidden = tag->getBool("hidden");