Hi all, Thanks to Felipe for catching this issue[1]. Both http-enumerator and http-conduit will not properly reject invalid certificates. I've released updated versions of both packages: http-enumerator-0.7.2.4 http-conduit-1.1.2.2 All users are recommended to upgrade. Michael [1] https://github.com/snoyberg/http-conduit/pull/6