(superset) branch fix/smtp-ssl-server-auth-default created (now f5450686fb4)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch fix/smtp-ssl-server-auth-default
in repository https://gitbox.apache.org/repos/asf/superset.git


      at f5450686fb4 chore(config): default SMTP_SSL_SERVER_AUTH to True

This branch includes the following new commits:

     new f5450686fb4 chore(config): default SMTP_SSL_SERVER_AUTH to True

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: chore(config): default SMTP_SSL_SERVER_AUTH to True

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/smtp-ssl-server-auth-default
in repository https://gitbox.apache.org/repos/asf/superset.git

commit f5450686fb4f571e333b292cc684bb4f4f0e0f53
Author: Claude Code <no...@anthropic.com>
AuthorDate: Mon Jun 1 17:23:21 2026 -0700

    chore(config): default SMTP_SSL_SERVER_AUTH to True
    
    Change the shipped default for SMTP_SSL_SERVER_AUTH from False to True so
    STARTTLS/SSL connections to the SMTP server validate the server's TLS
    certificate against the system CA store out of the box.
    
    The setting remains overridable: operators using a self-signed or otherwise
    untrusted certificate can restore the previous behavior by setting
    SMTP_SSL_SERVER_AUTH = False in superset_config.py.
    
    Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
 UPDATING.md                     | 12 ++++++++++++
 superset/config.py              |  9 +++++++--
 tests/unit_tests/config_test.py | 10 ++++++++++
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/UPDATING.md b/UPDATING.md
index ea73f6adf63..c39690c11e6 100644
--- a/UPDATING.md
+++ b/UPDATING.md
@@ -24,6 +24,18 @@ assists people when migrating to a new version.
 
 ## Next
 
+### SMTP server certificate validation enabled by default
+
+`SMTP_SSL_SERVER_AUTH` now defaults to `True` (previously `False`). With this default, STARTTLS/SSL connections to the configured SMTP server validate the server's TLS certificate against the system trusted CA store. This makes outbound email (alerts and reports) verify the mail server's identity out of the box.
+
+If your SMTP server presents a self-signed certificate, or a certificate that is not trusted by the system CA store, email delivery may now fail with a certificate verification error. To restore the previous behavior of skipping certificate validation, set the following in `superset_config.py`:
+
+```python
+SMTP_SSL_SERVER_AUTH = False
+```
+
+The recommended fix is to add the SMTP server's certificate (or its issuing CA) to the system trust store rather than disabling validation.
+
 ### Dataset import validates catalog against the target connection
 
 Importing a dataset now validates the `catalog` field against the target database connection. When the connection has multi-catalog disabled (`allow_multi_catalog` off) and the dataset's catalog is not the connection's default catalog, the import fails instead of silently persisting the non-default catalog. This matches the validation already enforced on the dataset update path and prevents imported datasets from querying an unintended database.
diff --git a/superset/config.py b/superset/config.py
index cd64e54bcc8..33cfdd7efd4 100644
--- a/superset/config.py
+++ b/superset/config.py
@@ -1635,8 +1635,13 @@ SMTP_PORT = 25
 SMTP_PASSWORD = "superset"  # noqa: S105
 SMTP_MAIL_FROM = "superset@superset.com"
 # If True creates a default SSL context with ssl.Purpose.CLIENT_AUTH using the
-# default system root CA certificates.
-SMTP_SSL_SERVER_AUTH = False
+# default system root CA certificates. This makes STARTTLS/SSL connections to the
+# SMTP server validate the server's certificate against the trusted CA store.
+# Defaults to True so the mail server identity is verified out of the box. Set to
+# False to restore the previous behavior of skipping certificate validation (for
+# example, when using a self-signed certificate that is not in the system CA
+# store).
+SMTP_SSL_SERVER_AUTH = True
 ENABLE_CHUNK_ENCODING = False
 
 # Whether to bump the logging level to ERROR on the flask_appbuilder package
diff --git a/tests/unit_tests/config_test.py b/tests/unit_tests/config_test.py
index 571b789108f..817b806eeaf 100644
--- a/tests/unit_tests/config_test.py
+++ b/tests/unit_tests/config_test.py
@@ -312,3 +312,13 @@ def test_full_setting(
     assert dttm_col.is_dttm
     assert dttm_col.python_date_format == "epoch_s"
     assert dttm_col.expression == "CAST(dttm as INTEGER)"
+
+
+def test_smtp_ssl_server_auth_defaults_to_true() -> None:
+    """
+    The shipped default for SMTP_SSL_SERVER_AUTH validates the SMTP server's
+    TLS certificate. Operators can still opt out by overriding it to False.
+    """
+    from superset import config
+
+    assert config.SMTP_SSL_SERVER_AUTH is True