Tighten up the TLS requirements for server links.

Servers must now either provide a fingerprint in the link config or provide a
valid certificate. There's an undocumented (for now) opt-out in the config but
even with this set it still doesn't allow expired, revoked, or otherwise invalid
certificates.

1 files changed, 0 insertions, 9 deletions

diff --git a/modules/spanningtree/hmac.cpp b/modules/spanningtree/hmac.cpp
index c56678ff7..6f445f175 100644
--- a/modules/spanningtree/hmac.cpp
+++ b/modules/spanningtree/hmac.cpp
@@ -75,7 +75,6 @@ bool TreeSocket::ComparePass(const Link& link, const std::string& theirs)
 	const auto* tlshook = TLS::GetHook(this);
 	const auto& tlscert = tlshook ? tlshook->GetCertificate() : nullptr;
 	const auto tlscert_usable = tlscert && tlscert->IsUsable();
-	const auto fp = tlscert_usable ? tlscert->GetFingerprint() : "";
 	if (capab->auth_fingerprint)
 	{
 		std::string tlserror;
@@ -130,13 +129,5 @@ bool TreeSocket::ComparePass(const Link& link, const std::string& theirs)
 			return false;
 	}
 
-	// Tell opers to set up fingerprint verification if it's not already set up and the TLS mod gave us a fingerprint
-	// this time
-	if ((!capab->auth_fingerprint) && (!fp.empty()))
-	{
-		ServerInstance->SNO.WriteToSnoMask('l', "TLS client certificate fingerprint for link {} is \"{}\". "
-			"You can improve security by specifying this in <link:fingerprint>.", link.Name, fp);
-	}
-
 	return true;
 }