From 3d150ba5da604569f075b20cc560e7d04aeac993 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sat, 4 Apr 2026 01:41:38 +0100
Subject: Tighten up the TLS requirements for server links.

Servers must now either provide a fingerprint in the link config or provide a
valid certificate. There's an undocumented (for now) opt-out in the config but
even with this set it still doesn't allow expired, revoked, or otherwise invalid
certificates.
---
 modules/spanningtree/hmac.cpp | 9 ---------
 1 file changed, 9 deletions(-)

(limited to 'modules/spanningtree/hmac.cpp')

diff --git a/modules/spanningtree/hmac.cpp b/modules/spanningtree/hmac.cpp
index c56678ff7..6f445f175 100644
--- a/modules/spanningtree/hmac.cpp
+++ b/modules/spanningtree/hmac.cpp
@@ -75,7 +75,6 @@ bool TreeSocket::ComparePass(const Link& link, const std::string& theirs)
 	const auto* tlshook = TLS::GetHook(this);
 	const auto& tlscert = tlshook ? tlshook->GetCertificate() : nullptr;
 	const auto tlscert_usable = tlscert && tlscert->IsUsable();
-	const auto fp = tlscert_usable ? tlscert->GetFingerprint() : "";
 	if (capab->auth_fingerprint)
 	{
 		std::string tlserror;
@@ -130,13 +129,5 @@ bool TreeSocket::ComparePass(const Link& link, const std::string& theirs)
 			return false;
 	}
 
-	// Tell opers to set up fingerprint verification if it's not already set up and the TLS mod gave us a fingerprint
-	// this time
-	if ((!capab->auth_fingerprint) && (!fp.empty()))
-	{
-		ServerInstance->SNO.WriteToSnoMask('l', "TLS client certificate fingerprint for link {} is \"{}\". "
-			"You can improve security by specifying this in <link:fingerprint>.", link.Name, fp);
-	}
-
 	return true;
 }
-- 
cgit v1.3.1-10-gc9f91