Revert "Fetch cert allow insecure (#8998)" (#9585)

This reverts commit 25d7f393b6.

v2rayN/ServiceLib/Manager/CertPemManager.cs

@@ -190,8 +190,8 @@ public class CertPemManager
     /// <summary>
     ///     Get certificate in PEM format from a server with CA pinning validation
     /// </summary>
-    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName, int timeout = 4,
+    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName,
-        List<string>? verifyPeerCertByName = null, bool allowInsecure = false)
+        List<string>? verifyPeerCertByName = null, int timeout = 4)
     {
         try
         {
@@ -204,8 +204,7 @@ public class CertPemManager
             await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);
 
             var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
-                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? [],
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? []));
-                    allowInsecure));
             await using var ssl = new SslStream(client.GetStream(), false, callback);
 
             var sslOptions = new SslClientAuthenticationOptions
@@ -240,8 +239,8 @@ public class CertPemManager
     /// <summary>
     ///     Get certificate chain in PEM format from a server with CA pinning validation
     /// </summary>
-    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName, int timeout = 4,
+    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName,
-        List<string>? verifyPeerCertByName = null, bool allowInsecure = false)
+        List<string>? verifyPeerCertByName = null, int timeout = 4)
     {
         var pemList = new List<string>();
         try
@@ -255,8 +254,7 @@ public class CertPemManager
             await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);
 
             var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
-                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? [],
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? []));
-                    allowInsecure));
             await using var ssl = new SslStream(client.GetStream(), false, callback);
 
             var sslOptions = new SslClientAuthenticationOptions
@@ -299,20 +297,13 @@ public class CertPemManager
         X509Certificate? certificate,
         X509Chain? chain,
         SslPolicyErrors sslPolicyErrors,
-        List<string> verifyPeerCertByName,
+        List<string> verifyPeerCertByName)
-        bool allowInsecure)
     {
         if (certificate == null)
         {
             return false;
         }
 
-        // In insecure mode, accept any certificate so self-signed certs can be fetched.
-        if (allowInsecure)
-        {
-            return true;
-        }
-
         // Build certificate chain
         var cert2 = certificate as X509Certificate2 ?? new X509Certificate2(certificate);
         var certChain = chain ?? new X509Chain();

v2rayN/ServiceLib/Resx/ResUI.Designer.cs

@@ -2670,24 +2670,6 @@ namespace ServiceLib.Resx {
             }
         }
         
-        /// <summary>
-        ///   查找类似 Allow insecure cert fetch (self-signed) 的本地化字符串。
-        /// </summary>
-        public static string TbAllowInsecureCertFetch {
-            get {
-                return ResourceManager.GetString("TbAllowInsecureCertFetch", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 Only for fetching self-signed certificates. This may expose you to MITM risks. 的本地化字符串。
-        /// </summary>
-        public static string TbAllowInsecureCertFetchTips {
-            get {
-                return ResourceManager.GetString("TbAllowInsecureCertFetchTips", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   查找类似 ALPN 的本地化字符串。
         /// </summary>

v2rayN/ServiceLib/Resx/ResUI.fa.resx

@@ -1698,12 +1698,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Allow insecure cert fetch (self-signed)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>Test Configurations UDP Delay</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.fr.resx

@@ -1695,12 +1695,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Allow insecure cert fetch (self-signed)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Pour obtenir des certificats auto-signés uniquement. Risque MITM.</value>
-  </data>
   <data name="TbSettingsSendThrough" xml:space="preserve">
     <value>Adresse de sortie locale (SendThrough)</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.hu.resx

@@ -1698,12 +1698,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Allow insecure cert fetch (self-signed)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>Test Configurations UDP Delay</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.resx

@@ -1701,12 +1701,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Allow insecure cert fetch (self-signed)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>Test Configurations UDP Delay</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.ru.resx

@@ -1698,12 +1698,6 @@
   <data name="TransportExtra" xml:space="preserve">
     <value>Дополнительные параметры XHTTP (Extra)</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Разрешить небезопасную загрузку сертификата (самоподписанного)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Только для загрузки самоподписанных сертификатов. Это может подвергнуть вас риску атаки «человек посередине» (MITM).</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>Тест UDP-задержки конфигураций</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.zh-Hans.resx

@@ -1695,12 +1695,6 @@
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>允许不安全获取证书（自签名）</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>仅用于抓取自签证书，存在中间人风险。</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>测试 UDP 延迟 (多选)</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.zh-Hant.resx

@@ -1695,12 +1695,6 @@
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>允許不安全獲取證書（自簽名）</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>僅用於抓取自簽證書，存在中間人風險。</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>測試 UDP 延遲（多選）</value>
   </data>

v2rayN/ServiceLib/ViewModels/AddServerViewModel.cs

@@ -23,9 +23,6 @@ public class AddServerViewModel : MyReactiveObject
     [Reactive]
     public string CertSha { get; set; }
 
-    [Reactive]
-    public bool AllowInsecureCertFetch { get; set; }
-
     [Reactive]
     public string SalamanderPass { get; set; }
 
@@ -475,8 +472,7 @@ public class AddServerViewModel : MyReactiveObject
         }
 
         (Cert, var certError) = await CertPemManager.Instance.GetCertPemAsync(domain, serverName,
-            verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName),
+            verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName));
-            allowInsecure: AllowInsecureCertFetch);
         UpdateCertTip(certError);
     }
 
@@ -502,8 +498,7 @@ public class AddServerViewModel : MyReactiveObject
         }
 
         var (certs, certError) = await CertPemManager.Instance.GetCertChainPemAsync(domain, serverName,
-            verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName),
+            verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName));
-            allowInsecure: AllowInsecureCertFetch);
         Cert = CertPemManager.ConcatenatePemChain(certs);
         UpdateCertTip(certError);
     }

v2rayN/v2rayN.Desktop/Views/AddServerWindow.axaml

@@ -1189,25 +1189,6 @@
                                                 Margin="{StaticResource Margin4}"
                                                 Content="{x:Static resx:ResUI.TbFetchCertChain}" />
                                         </StackPanel>
-                                        <StackPanel HorizontalAlignment="Left" Orientation="Horizontal">
-                                            <TextBlock
-                                                Margin="{StaticResource Margin4}"
-                                                VerticalAlignment="Center"
-                                                Text="{x:Static resx:ResUI.TbAllowInsecureCertFetch}" />
-                                            <ToggleSwitch
-                                                x:Name="togAllowInsecureCertFetch"
-                                                Margin="{StaticResource Margin4}"
-                                                HorizontalAlignment="Left" />
-                                        </StackPanel>
-                                        <TextBlock
-                                            x:Name="txtAllowInsecureCertFetchTips"
-                                            Width="400"
-                                            Margin="{StaticResource Margin4}"
-                                            VerticalAlignment="Center"
-                                            Foreground="#FFD32F2F"
-                                            IsVisible="False"
-                                            Text="{x:Static resx:ResUI.TbAllowInsecureCertFetchTips}"
-                                            TextWrapping="Wrap" />
                                         <TextBlock
                                             Width="400"
                                             Margin="{StaticResource Margin4}"

v2rayN/v2rayN.Desktop/Views/AddServerWindow.axaml.cs

@@ -236,8 +236,6 @@ public partial class AddServerWindow : WindowBase<AddServerViewModel>
             this.Bind(ViewModel, vm => vm.CertSha, v => v.txtCertSha256Pinning.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.CertTip, v => v.labCertPinning.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.Cert, v => v.txtCert.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.AllowInsecureCertFetch, v => v.togAllowInsecureCertFetch.IsChecked).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.AllowInsecureCertFetch, v => v.txtAllowInsecureCertFetchTips.IsVisible).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.SelectedSource.EchConfigList, v => v.txtEchConfigList.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.SelectedSource.VerifyPeerCertByName, v => v.txtVerifyPeerCertByName.Text).DisposeWith(disposables);
 

v2rayN/v2rayN/Views/AddServerWindow.xaml

@@ -1519,27 +1519,6 @@
                                         Content="{x:Static resx:ResUI.TbFetchCertChain}"
                                         Style="{StaticResource DefButton}" />
                                 </StackPanel>
-                                <StackPanel HorizontalAlignment="Left" Orientation="Horizontal">
-                                    <TextBlock
-                                        Margin="{StaticResource Margin4}"
-                                        VerticalAlignment="Center"
-                                        Style="{StaticResource ToolbarTextBlock}"
-                                        Text="{x:Static resx:ResUI.TbAllowInsecureCertFetch}" />
-                                    <ToggleButton
-                                        x:Name="togAllowInsecureCertFetch"
-                                        Margin="{StaticResource Margin4}"
-                                        HorizontalAlignment="Left" />
-                                </StackPanel>
-                                <TextBlock
-                                    x:Name="txtAllowInsecureCertFetchTips"
-                                    Width="400"
-                                    Margin="{StaticResource Margin4}"
-                                    VerticalAlignment="Center"
-                                    Foreground="#FFD32F2F"
-                                    Style="{StaticResource ToolbarTextBlock}"
-                                    Text="{x:Static resx:ResUI.TbAllowInsecureCertFetchTips}"
-                                    TextWrapping="Wrap"
-                                    Visibility="Collapsed" />
                                 <TextBlock
                                     Width="400"
                                     Margin="{StaticResource Margin4}"

v2rayN/v2rayN/Views/AddServerWindow.xaml.cs

@@ -234,10 +234,6 @@ public partial class AddServerWindow
             this.Bind(ViewModel, vm => vm.CertSha, v => v.txtCertSha256Pinning.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.CertTip, v => v.labCertPinning.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.Cert, v => v.txtCert.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.AllowInsecureCertFetch, v => v.togAllowInsecureCertFetch.IsChecked).DisposeWith(disposables);
-            this.WhenAnyValue(x => x.ViewModel.AllowInsecureCertFetch)
-                .Select(b => b ? Visibility.Visible : Visibility.Collapsed)
-                .BindTo(this, v => v.txtAllowInsecureCertFetchTips.Visibility);
             this.Bind(ViewModel, vm => vm.Cert, v => v.txtCert.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.SelectedSource.EchConfigList, v => v.txtEchConfigList.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.SelectedSource.VerifyPeerCertByName, v => v.txtVerifyPeerCertByName.Text).DisposeWith(disposables);