connection: SSL connections doesn't do hostname verification of the server its connecting to

[skepticfx]

The latest version of Mongoid, doesn't seem to do hostname validation on the SSL connections. This opens the SSL connections to man in the middle attacks, thus making the SSL feature almost futile.

The Ruby driver does this and provides options to do so, by taking the option called ssl_verify and ssl_ca_cert which seems to be completely missing in Mongoid 4.x

Is there any way to get this working and do proper hostname validation of the servers?

[buth]

+1.

[skepticfx]

Apparently this commit: dc21475 had the options necessary to do proper hostname validation and for some reason its been removed now.

[chrisckchang]

+1

[thijsc]

I have a pull request open for this: https://github.com/mongoid/moped/pull/309/files