related issue: #19215

CC @neild @bradfitz

If I understand this correctly, setting this environment variable would make all net/http connections insecure even if they appeared to be secure. That's a pretty broad scope for security attacks. It doesn't sound like a good idea to make it quite that easy to make all Go programs that use net/http less secure.

That said, if we do use an environment variable, it should be GODEBUG, a variable that we already use.

But better than an environment variable might be some sort of programmatic option somewhere. Then at least the insecurity would be limited to a program that uses that feature, rather than all Go programs that use net/http.

You can disable certificate verification by setting tls.Config.InsecureSkipVerify. I believe this matches the effect of curl's -k flag on TLS connections.

I don't think we'd want to support an environment variable that disables TLS validation; that seems tremendously risky. It's simple enough to wire up an environment variable to InsecureSkipVerify in user code if you want that behavior.

Thanks. I'm going to preemptively close this proposal. I don't see any way that we would do this. Please comment if you disagree.