Risk level: High (P1)

The tls_skip_verify: true backend config parameter disables server TLS certificate verification. This is acceptable only in a dev/test environment with self-signed certificates.

⚠️ NEVER use tls_skip_verify: true in production.

With tls_skip_verify: true, rproxy accepts any certificate from the backend, including a forged one. An attacker positioned between rproxy and the backend (a MITM attack) can:

• intercept and modify traffic
• steal authorization tokens and sensitive data
• inject malicious content into responses

1. Production: always use valid certificates (Let's Encrypt, an internal CA).
2. Dev/testing: tls_skip_verify: true with self-signed certificates is acceptable.
3. Internal CA: for internal services, configure a trusted root certificate instead of disabling verification.
4. Monitoring: rproxy logs a warning (tracing::warn) whenever tls_skip_verify: true is in effect — monitor these entries.

The TLS certificate and private key paths can be set via:

Environment variables take priority over the config file.

• key.pem — mode 0600 (owner read/write only)
• cert.pem — mode 0644 (world-readable, owner-writable)
• Both files are in .gitignore (*.pem); private keys are never committed.