[rabbitmq-discuss] Broker accepts self-signed client certificate in verify_peer mode

[jiri at krutil.com]

> Yes. I assure you this was not the behaviour of Erlang when I wrote the
> SSL guide. Unfortunately, a fix is not going to happen in time for the
> next release, but we're going to chase the Erlang SSL module authors to
> see if there's any reason for this behaviour, and I hope will change it
> either in their code or ours. I agree with you that with verify_peer on,
> the broker *must not* blindly trust *any* certs without being able to
> establish a chain of trust to the presented cert.

Hi Matthew,

thanks for clarifying this.

Do you have a publicly accessible bug tracking system where we could  
follow this issue and see when is it resolved?

Cheers
Jiri