Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and UPSTREAMSSLVERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts any certificate, including self-signed and otherwise untrusted certificates, without validating the chain. An attacker positioned to intercept traffic between Socket Firewall and the Socket API or an upstream package registry can present a crafted certificate and modify responses in transit, including substituting malicious package content or altering the allow/block decisions the firewall enforces. Setting apisslverify: true and upstreamsslverify: true enables verification; however, in versions before 1.1.334, the generated nginx configuration did not emit luassltrustedcertificate, and thus verification could not be used successfully without manually patching the generated configuration. Version 2.0.0 changes the default for both settings to true.