Mark/vikunja-cli
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Gap: No SSL/TLS verification configuration for self-signed certificates #9

New issue
Closed
opened 2026-05-09 05:18:46 +00:00 by Mark · 1 comment
Mark commented 2026-05-09 05:18:46 +00:00
Owner
Copy link

Severity: Low

The requests Session used in APIClient.__init__ (both vikunja_cli/api/client.py and vikunjatool/api/client.py) does not expose any way to disable SSL verification or use custom CA bundles. Users running self-hosted Vikunja instances with self-signed or internal CA certificates cannot connect.

There is no --insecure flag, --ca-bundle option, or environment variable support.

Fix:

  1. Add a global --insecure / --skip-verify flag that sets verify=False on the Session
  2. Add a --ca-bundle flag to specify a custom CA certificate path
  3. Support REQUESTS_CA_BUNDLE / SSL_CERT_FILE environment variables (requests does this already, but it should be documented)

This is especially important for a CLI targeting self-hosted instances, where custom TLS is common.

**Severity: Low** The requests Session used in `APIClient.__init__` (both `vikunja_cli/api/client.py` and `vikunjatool/api/client.py`) does not expose any way to disable SSL verification or use custom CA bundles. Users running self-hosted Vikunja instances with self-signed or internal CA certificates cannot connect. There is no `--insecure` flag, `--ca-bundle` option, or environment variable support. **Fix:** 1. Add a global `--insecure` / `--skip-verify` flag that sets `verify=False` on the Session 2. Add a `--ca-bundle` flag to specify a custom CA certificate path 3. Support `REQUESTS_CA_BUNDLE` / `SSL_CERT_FILE` environment variables (requests does this already, but it should be documented) This is especially important for a CLI targeting self-hosted instances, where custom TLS is common.
Mark commented 2026-05-12 19:20:09 +00:00
Author
Owner
Copy link

Fixed in commit. Closing.

Fixed in commit. Closing.
Mark closed this issue 2026-05-12 19:20:10 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:gate-research

   
bug

Bug report

  
feature-request

   
in-progress

Worker is actively processing this issue

  
needs-triage

   
quickfix

   
security/medium

Medium severity security issue

  
triage-approved
No labels
blocked:gate-research
bug
feature-request
in-progress
needs-triage
quickfix
security/medium
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/vikunja-cli#9
No description provided.