OIDCOutgoingProxy handling of insecure connection

[chrisinmtown]

How does mod_auth_oidc handle insecure connections when fetching OIDC metadata via a proxy? I don't see a config-file entry for this. Just trying to be clear what I mean, for example curl uses flag/ -k/--insecure so you can tell it to ignore certificate problems.

Context: I configure the module with a value in item OIDCOutgoingProxy to use a man-in-the-middle proxy for fetching metadata from the OIDC server. That proxy has its own internal root certificate. I'm trying to figure out how to provide that root certificate. Bafflingly to me, the authorization seems to work just fine without that fake cert. However it seems unlikely that insecure connections are silently ignored.

Closely related, does the module log its use of an outgoing proxy? I turned up logging via LogLevel auth_openidc:debug in the https-ssl.conf file. I see lots of output tagged [auth_openidc:debug]. However I don't see any mention of the configured proxy server, and certainly no complaints about insecure connections due to certificate problems.

Thanks in advance.

[zandbelt]

all outgoing requests are handled through libcurl (hence no explicit transport traces) which (typically) uses the system CA store for TLS server certificate validation; you can also use OIDCSSLValidateServer Off or OIDCCABundlePath

[chrisinmtown]

Thank you @zandbelt for the quick reply! That helps.