Why is this an issue?

Validation of X.509 certificates is essential to create secure SSL/TLS sessions not vulnerable to man-in-the-middle attacks.

The certificate chain validation includes these steps:

It’s not recommended to reinvent the wheel by implementing custom certificate chain validation.

TLS libraries provide built-in certificate validation functions that should be used.

Noncompliant code example

HTTP request tools such as curl, wget and Invoke-WebRequest offer the option to disable certificate verification. The following example successfully requests data from a server with an insecure certificate. Thus, it is possible that the response was intercepted or tampered with by a third party.

FROM ubuntu:22.04

# Noncompliant
RUN curl --insecure -O https://expired.example.com/downloads/install.sh

Compliant solution

Enabling certificate verification helps to make sure that the created TLS session is secure and cannot be intercepted. In this example, the option to disable certificate verification is removed, and a request is made to a secure server instead.

FROM ubuntu:22.04

RUN curl -O https://new.example.com/downloads/install.sh

Resources