Skip to content

Email disableTLS site config property is misnamed

Created by: sqs

The name of the email.smtp disableTLS property implies that it disables TLS (i.e., encryption is not used for the SMTP connection), but it actually skips TLS verification (i.e., encryption is used, but the identity of the peer is not verified).

Introduced in https://github.com/sourcegraph/sourcegraph/pull/11832. This problem was mentioned by @unknwon in https://github.com/sourcegraph/sourcegraph/issues/10702#issuecomment-655935306:

What we want here is to skip TLS verify but not necessarily disable TLS (though another valid option).

I just noticed this when reading through the changelog; it hasn't come up as an issue in actual usage or from a customer.