ntfy: possibility to ignore self created ca certificates

[maikxmh]

Is your feature request related to a problem? Please describe.

Hello,

I like watchtower a lot and I just set up my own ntfy server in my homelab. It uses a certificate signed by my own CA and when I try to use ntfy within watchtower I get the following messages:

time="2023-11-13T16:16:00Z" level=error msg="Failed to send shoutrrr notification" error="failed to send ntfy notification: error sending payload: Post \"https://ntfy.local/blablabla\": x509: certificate signed by unknown authority" index=0 notify=no service=ntfy

It's an internal URL.. Is there a possibility to add a parameter to ignore the TLS error?

Thanks and regards
Maik

Describe the solution you'd like

add a new parameter to ignore self-signed certificates for ntfy instances

Describe alternatives you've considered

allow HTTP (port 80) internal but I don't like the idea..

Additional context

No response

[piksel]

Ignoring self-signed certificates is worse than allowing HTTP, as it makes it possible to MitM properly secured HTTPS endpoints. Allowing traffic on HTTP is an opt-in that the service provider would enable if they deemed it safe (such as in an internal network).

That being said, what we really want to add (globally in shoutrrr) is the possibility of providing additional trusted CAs.

Disabling TLS verification is a automated security scan red flag, so I don't think that is something we will be adding it to shoutrrr (the only way to enable self-signed certificates).

[maikxmh]

"That being said, what we really want to add (globally in shoutrrr) is the possibility of providing additional trusted CAs."

sounds perfect and the way to go !

[parasiteoflife]

Why don't add this as an option for all services that are selfhostable? I don't really see how adding the option to not verify (of course defaulting to yes) would be worst than allowing HTTP, do you really think the users will add the parameter just because? As an example Apprise allows this.

[piksel]

It's not I/we that think anything. It's the fact that adding code that bypasses https verification would mark the library as having a critical security issue.

[maikxmh]

Is there a possibility to add custom root CA for self hosted services? This is needed … switching to http is no option.