From 9735d3f3df1ab8323a96ce831e1a6683a4428b6f Mon Sep 17 00:00:00 2001
From: Daniel Karzel <daniel.karzel@coblox.tech>
Date: Thu, 16 Apr 2020 19:16:15 +1000
Subject: [PATCH] add danger clause for ignoring invalid certificates

needed to make e2e test pass on macOS Catalina
---
 cnd/src/swap_protocols/halight/connector.rs | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/cnd/src/swap_protocols/halight/connector.rs b/cnd/src/swap_protocols/halight/connector.rs
index 6bd3223381..35e30d9dac 100644
--- a/cnd/src/swap_protocols/halight/connector.rs
+++ b/cnd/src/swap_protocols/halight/connector.rs
@@ -444,8 +444,24 @@ fn client(certificate: &Certificate, macaroon: &Macaroon) -> Result<reqwest::Cli
         HeaderValue::from_str(&macaroon.0)?,
     );
 
-    Ok(reqwest::Client::builder()
+    // The generated, self-signed lnd certificate is deemed invalid on macOS
+    // Catalina because of new certificate requirements in macOS Catalina: https://support.apple.com/en-us/HT210176
+    // By using this conditional compilation step for macOS we accept invalid
+    // certificates. This is only a minimal security risk because by default the
+    // certificate that lnd generates is configured to only allow connections
+    // from localhost. Ticket that will resolve that issue: https://github.com/lightningnetwork/lnd/issues/4201
+    #[cfg(target_os = "macos")]
+    let client = reqwest::Client::builder()
+        .danger_accept_invalid_certs(true)
         .add_root_certificate(cert)
         .default_headers(default_headers)
-        .build()?)
+        .build()?;
+
+    #[cfg(not(target_os = "macos"))]
+    let client = reqwest::Client::builder()
+        .add_root_certificate(cert)
+        .default_headers(default_headers)
+        .build()?;
+
+    Ok(client)
 }