Potential fix for pull request finding 'CodeQL / Disabling certificate validation'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: venkateshsakamuri-lab

desktop/src/main/tls.js

@@ -60,16 +60,16 @@ function readCaBundle(caPath) {
 
 /**
  * Node `https.request` options implementing the profile's policy.
- * In `pinned`/`insecure` mode Node's own chain check is disabled and replaced by
- * the fingerprint check in `checkPeerCertificate` — never skip that follow-up.
+ * Certificate validation must remain enabled; additional checks (like pinning)
+ * are additive and must not replace TLS verification.
  */
 function nodeTlsOptions(profile) {
   const mode = profile?.tls?.mode || 'system';
   if (mode === 'custom-ca') {
     return { ca: readCaBundle(profile.tls.caPath), rejectUnauthorized: true };
   }
   if (mode === 'pinned' || mode === 'insecure') {
-    return { rejectUnauthorized: false };
+    return { rejectUnauthorized: true };
   }
   return { rejectUnauthorized: true };
 }