{"id":23591,"date":"2026-08-23T23:20:28","date_gmt":"2026-08-23T21:20:28","guid":{"rendered":"https:\/\/www.salvis.com\/blog\/?p=23591"},"modified":"2026-08-23T23:20:31","modified_gmt":"2026-08-23T21:20:31","slug":"the-checkbox-that-disables-tls","status":"publish","type":"post","link":"https:\/\/www.salvis.com\/blog\/2026\/08\/23\/the-checkbox-that-disables-tls\/","title":{"rendered":"The Checkbox That Disables TLS"},"content":{"rendered":"\n

Introduction<\/h2>\n\n\n\n

The dbLinter clients include a new setting named Allow Insecure TLS<\/code>. It is disabled by default. As a result, all REST API calls verify the TLS certificate and hostname. <\/p>\n\n\n\n

The setting allows dbLinter to work in organisations that inspect TLS traffic using tools such as Zscaler<\/a>.<\/p>\n\n\n\n

In larger organisations, arranging an inspection bypass can be cumbersome and is often too much effort for an ad-hoc trial of dbLinter. The checkbox provides a temporary workaround and should be enabled only on a trusted network.<\/p>\n\n\n\n

However, allowing insecure TLS on untrusted networks, such as open Wi-Fi without client isolation, can let an attacker redirect traffic through their own machine using techniques like ARP spoofing<\/a>. The attacker can also operate the access point themselves, for example, by creating a rogue Wi-Fi hotspot.<\/p>\n\n\n\n

In this blog post, I demonstrate the effect of this checkbox.<\/p>\n\n\n\n

Allow Insecure TLS<\/h2>\n\n\n\n

The latest version of dbLinter for VS Code has a checkbox that disables certificate and hostname verification.<\/p>\n\n\n\n

\"Allow<\/a><\/figure>\n\n\n\n

dbLinter’s allowInsecureTls<\/code> setting is nothing unusual. Many common tools offer a similar option, including curl (--insecure<\/code>), wget (--no-check-certificate<\/code>), and git (--config http.sslVerify false<\/code>).<\/p>\n\n\n\n

Installing and Configuring a Proxy<\/h2>\n\n\n\n

I run this demo on macOS 26.6.2.<\/p>\n\n\n\n

A simple proxy is mitmweb<\/a>. We can install and configure it as follows:<\/p>\n\n\n\n

<\/circle><\/circle><\/circle><\/g><\/svg><\/span>