starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Remove the ssl_verification field from the Webhook model #9342

New Issue
Closed
opened 2025-12-29 20:48:44 +01:00 by adam · 5 comments
adam commented 2025-12-29 20:48:44 +01:00
Owner
Copy Link

Originally created by @jeremystretch on GitHub (Mar 8, 2024).

Proposed Changes

Remove the ssl_verification field from the Webhook model. If enabled, this bypasses validation of the SSL certificate on the remote server.

Justification

Disabling certificate validation presents a legitimate security concern, as it exposes outgoing webhooks to interception by a third party.

Impact

NetBox will need to be able to validate the SSL certificate of any HTTPS-enabled remote receivers.

Originally created by @jeremystretch on GitHub (Mar 8, 2024). ### Proposed Changes Remove the `ssl_verification` field from the Webhook model. If enabled, this bypasses validation of the SSL certificate on the remote server. ### Justification Disabling certificate validation presents a legitimate security concern, as it exposes outgoing webhooks to interception by a third party. ### Impact NetBox will need to be able to validate the SSL certificate of any HTTPS-enabled remote receivers.
adam added the type: deprecationbreaking change labels 2025-12-29 20:48:44 +01:00
adam closed this issue 2025-12-29 20:48:45 +01:00
adam commented 2025-12-29 20:48:45 +01:00
Author
Owner
Copy Link

@peteeckel commented on GitHub (Mar 9, 2024):

While I absolutely agree that SSL verification should be the default and enabled whenever possible, I am pretty sure that removing the option to disable SSL verification will cause a lot of problems in many environments.

Many of my customers, especially the smaller ones with understaffed IT departments, use their internal CAs or even self-signed certificates for internal systems (which in my experience are the majority of target servers for Webhooks), and don't have a sensible way of distributing their CAs root certificates to all systems. While that's certainly not optimal, it's unfortunately the status quo. The fact that it's not exactly straightforward to add your own CA for systems using requests and certifi does not help either, as they don't use the system trust store.

Removing the option of disabling SSL verification will break Webhooks in these cases, and the quick and dirty solution to this is to disable TLS altogether and communicate in clear text, which is much worse than unvalidated TLS.

My two cents: Display a visible warning when ssl_verification is disabled, but leave it in place.

@peteeckel commented on GitHub (Mar 9, 2024): While I absolutely agree that SSL verification should be the default and enabled whenever possible, I am pretty sure that removing the option to disable SSL verification will cause a lot of problems in many environments. Many of my customers, especially the smaller ones with understaffed IT departments, use their internal CAs or even self-signed certificates for internal systems (which in my experience are the majority of target servers for Webhooks), and don't have a sensible way of distributing their CAs root certificates to all systems. While that's certainly not optimal, it's unfortunately the status quo. The fact that it's not exactly straightforward to add your own CA for systems using `requests` and `certifi` does not help either, as they don't use the system trust store. Removing the option of disabling SSL verification will break Webhooks in these cases, and the quick and dirty solution to this is to disable TLS altogether and communicate in clear text, which is much worse than unvalidated TLS. My two cents: Display a visible warning when `ssl_verification` is disabled, but leave it in place.
adam commented 2025-12-29 20:48:46 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Mar 9, 2024):

The fact that it's not exactly straightforward to add your own CA for systems using requests and certifi does not help either, as they don't use the system trust store.

The webhook model also provides a mechanism for indicating the path to a specific CA file via its ca_file_path field, so I don't think we can consider this an argument against removing the ssl_verification field.

@jeremystretch commented on GitHub (Mar 9, 2024): > The fact that it's not exactly straightforward to add your own CA for systems using requests and certifi does not help either, as they don't use the system trust store. The webhook model also provides a mechanism for indicating the path to a specific CA file via its `ca_file_path` field, so I don't think we can consider this an argument against removing the `ssl_verification` field.
adam commented 2025-12-29 20:48:46 +01:00
Author
Owner
Copy Link

@SaschaSchwarzK commented on GitHub (Mar 9, 2024):

I would agree that it should be a configurable setting, default can be false.
In general I am all for it to make things secure, but forcing security upon netbox users will lead to a lot of frustration.
In large companies the management of certificates quickly becomes a resource intense tasks which only few have successfully automated.
This change would then also require to have proper certificate management for every test and development instance.

@SaschaSchwarzK commented on GitHub (Mar 9, 2024): I would agree that it should be a configurable setting, default can be false. In general I am all for it to make things secure, but forcing security upon netbox users will lead to a lot of frustration. In large companies the management of certificates quickly becomes a resource intense tasks which only few have successfully automated. This change would then also require to have proper certificate management for every test and development instance.
adam commented 2025-12-29 20:48:46 +01:00
Author
Owner
Copy Link

@bitcollector1 commented on GitHub (Mar 13, 2024):

I always laugh at my teammates who ignore SSL in all their scripts because it's too hard ;)

@bitcollector1 commented on GitHub (Mar 13, 2024): I always laugh at my teammates who ignore SSL in all their scripts because it's too hard ;)
adam commented 2025-12-29 20:48:47 +01:00
Author
Owner
Copy Link

@ITJamie commented on GitHub (May 6, 2024):

If someone gets in a situation where a cert has expired (or is using a self-signed cert) on a remote server if there is no way to bypass this they might instead choose to send in plaintext over HTTP. which would be worse than sending traffic to a https endpoint with an expired or self-signed cert.

@ITJamie commented on GitHub (May 6, 2024): If someone gets in a situation where a cert has expired (or is using a self-signed cert) on a remote server if there is no way to bypass this they might instead choose to send in plaintext over HTTP. which would be worse than sending traffic to a https endpoint with an expired or self-signed cert.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label breaking change type: deprecation
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#9342
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?