由于设置`set_verify_mode（boost :: asio :: ssl :: verify_none）;而导致的安全后果`

Question

I'm using this example as a template in a server/client pair I wrote. I honestly don't understand all the details on how the secure connection is done. I understand the simple private/public RSA encryption. We encrypt with a public key, and only private keys can open it. Is it as simple here? (this is not the real question here)

So my question is: In my client part I used set_verify_mode(boost::asio::ssl::verify_none); . Does this jeopardize the secure connection I'm using? Is the connection still secure and encrypted?

Answer 1

No, it's not safe setting SSL_VERIFY_NONE. In this case if someone attack the connection the client won't be able to verify the sender's identity.

Detailed description of server and client behaviour for each flags on openssl site:

https://www.openssl.org/docs/manmaster/ssl/SSL_CTX_set_verify.html