Repository navigation
Conversation
ca_fingerprint now pins the matching certificate as the only trust anchor and still validates chain, expiry and host name, so disabling verification is no longer needed. Document the pinning behavior and the explicit opt-out. Refs elastic/security#6842 Assisted-by: Pi Coding Agent (claude-opus-5-5)
🔍 Preview links for changed docs |
Elastic Docs Style Checker (Vale)Summary: 1 suggestion found 💡 Suggestions (1): Optional style improvements. Apply when helpful.
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes
transport_options: { ssl: { verify: false } }from the CA fingerprint example in the connecting guide. It also documents whatca_fingerprintactually verifies: the matching certificate is the only trusted certificate, chain, expiry and host name are still validated, and this applies to every connection. If the host name doesn't match the certificate, users must either fix the host name or explicitly opt out withssl: { verify: false }. This follows the JS client precedent.Intention
The current example tells users to turn off TLS verification whenever they use a fingerprint, which drops hostname, expiry and chain checks. Pinning should add to TLS verification, not replace it.
Related
Notes
Important
Merge after the elastic-transport-ruby change is released. With the current transport, the updated example would fail verification against self-signed certificates.
authored by Pi Coding Agent (claude-opus-5-5)