Skip to content

TLS certificate verification: opt-in security to preserve backward compatibility#2843

Merged
asim merged 4 commits intomasterfrom
copilot/update-tls-certificate-verification
Feb 3, 2026
Merged

TLS certificate verification: opt-in security to preserve backward compatibility#2843
asim merged 4 commits intomasterfrom
copilot/update-tls-certificate-verification

Conversation

Copy link
Contributor

Copilot AI commented Feb 3, 2026 •
edited
Loading

Addresses concerns about breaking production deployments with TLS changes. Default behavior remains InsecureSkipVerify: true to prevent rollout failures across distributed systems with self-signed certs or mixed CA trust.

Changes

  • Default behavior: Unchanged (InsecureSkipVerify: true) for backward compatibility
  • Opt-in security: MICRO_TLS_SECURE=true environment variable enables certificate verification
  • Deprecation warning: Single log message on startup guides migration to v6
  • Documentation: Migration guide covering multi-host deployments and certificate management

Usage

// Default (backward compatible, insecure)
broker := broker.NewHttpBroker()
// Logs: [SECURITY WARNING] TLS certificate verification is disabled...

// Opt-in secure mode
os.Setenv("MICRO_TLS_SECURE", "true")
broker := broker.NewHttpBroker()
// Certificate verification enabled

// Explicit secure config
broker := broker.NewHttpBroker(
    broker.TLSConfig(mls.SecureConfig()),
)

Rationale

  • No major version bump: Breaking change deferred to v6
  • Cross-host safety: All nodes use identical insecure default, avoiding CA trust issues during rollout
  • Production rollout: Zero coordination required for version upgrades; security enabled per-service
  • Migration path: Users adopt security incrementally before v6 makes it default

See docs/SECURITY_MIGRATION.md for deployment strategies.

Original prompt

This section details on the original issue you should resolve

<issue_title>[FEATURE] Insecure TLS Configuration: Skipping Certificate Verification</issue_title>
<issue_description>Is your feature request related to a problem? Please describe.
In the go-micro package, specifically in the file github.com/go-micro/go-micro/broker/http.go at line 84 within the newTransport function, there is a default configuration that skips TLS certificate verification. This behavior poses a serious security risk because it disables the mechanism that ensures the authenticity and integrity of the TLS connection. Without certificate verification, man-in-the-middle attacks become possible, allowing attackers to intercept, modify, or steal data transmitted over the network.

Describe the solution you'd like
To mitigate this security vulnerability, I propose updating the default TLS configuration to enforce certificate verification. This can be achieved by configuring the tls.Config object to include a valid RootCAs pool or by setting the InsecureSkipVerify flag to false, which is its default value. Doing so will ensure that connections are established only with servers presenting trusted certificates, enhancing the overall security posture of the application.

Additional context
It is crucial to consider the implications of disabling certificate verification in production environments. While it might simplify development or testing scenarios, it should never be enabled in any environment where sensitive data is handled. To address this issue properly, the default configuration should be updated to enforce certificate verification, and developers should be provided with clear documentation on how to configure exceptions for testing purposes only.
</issue_description>

<agent_instructions>Is this something we reliably do without breakages? </agent_instructions>

Comments on the Issue (you are @copilot in this section)

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI assigned Copilot and asim Feb 3, 2026
@asim
Fix insecure TLS configuration - make secure by default
0a951aa 
- Changed util/tls/Config() to be secure by default (InsecureSkipVerify=false)
- Added MICRO_TLS_INSECURE=true environment variable for development/testing
- Updated documentation to emphasize security-first approach
- Added comprehensive tests for TLS configuration
- All existing broker tests pass

Co-authored-by: asim <17530+asim@users.noreply.github.com>
Copilot AI changed the title [WIP] Update default TLS configuration to enforce certificate verification Security: Enable TLS certificate verification by default Feb 3, 2026
Copilot AI requested a review from asim February 3, 2026 15:38
Copilot AI and others added 2 commits February 3, 2026 15:47
@asim
Revert to backward-compatible TLS defaults to avoid breaking changes
7c48f8f 
- Reverted default to InsecureSkipVerify=true for backward compatibility
- Changed environment variable to MICRO_TLS_SECURE=true (opt-in security)
- Added deprecation warning that logs once per process
- Updated tests to reflect backward-compatible behavior
- Added comprehensive migration guide
- No breaking changes - production systems safe to upgrade
- Security improvement is opt-in via environment variable
- Planned breaking change for v6 with proper major version bump

Co-authored-by: asim <17530+asim@users.noreply.github.com>
@asim
Add TLS security update documentation
4821a39 
Co-authored-by: asim <17530+asim@users.noreply.github.com>
Copilot AI changed the title Security: Enable TLS certificate verification by default TLS certificate verification: opt-in security to preserve backward compatibility Feb 3, 2026
@asim asim marked this pull request as ready for review February 3, 2026 15:52
@asim asim merged commit 50ce1a5 into master Feb 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@asim asim Awaiting requested review from asim

Assignees

@asim asim

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[FEATURE] Insecure TLS Configuration: Skipping Certificate Verification

2 participants

@asim