Connector must validate the SSL certificate and self signed should be rejected by default.

[gsaluja9]

This can be over ridden by a parameter.
Affected artifacts would be

• adb config *
• documentation
• Some demos

Anywhere in user code where create_connector() is called, or Connector() is instantiated.

[vishakha041]

@gsaluja9 How does it impact the users that are just curious developers trying or people within companies but without approval yet?
We have two scenarios - one docker and one cloud that people use to try.

@drewaogle is this required by SOC2 ?

[drewaogle]

@vishakha041 no, this is not required by SOC2.

[drewaogle]

@vishakha041 but more to the point, I think this is a tricky security situation.

We don't want to make examples that say verify=false, as that will cause bad security, but for people just trying it out, if they don't use the cloud, they will get a confusing error.

One solution is to make the server not do TLS by default, but this isn't great, because you're decreasing security to .. increase security?

[gsaluja9]

@vishakha041 but more to the point, I think this is a tricky security situation.

We don't want to make examples that say verify=false, as that will cause bad security, but for people just trying it out, if they don't use the cloud, they will get a confusing error.

One solution is to make the server not do TLS by default, but this isn't great, because you're decreasing security to .. increase security?

I also gave this a considerable thought. How about we introduce some params in config, and offer 3 tiered solution in the SDK. Right now, we have 2, which is use_ssl = True | False

use_ssl = same meaning
if use_ssl is True:
use_ssl_hostname_verification = boolean to do a full certificate and hostname check.
ca_cert : path to pre shared ca certificate.

[gsaluja9]

@vishakha041 . Can you look at this #616 , and https://github.com/aperture-data/docs/pull/284 . This is an upcoming change that might make the self hosting users need to understand and perform an extra bit of setting up. This PR enables it in the test but test is a controlled environment.