From 4836eb0fa5aa85d19e7542d87bfca9594cc3f36a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 17 Oct 2026 03:56:21 +0000
Subject: [PATCH] Check both outcomes in the update_certs_pem client cert test

Make ClientCertStillRequired take the setup to apply, so the
update_certs_pem test runs the same pair as the verify callback tests:
a client without a certificate is rejected and one with a certificate
is still accepted. Rejection alone would also pass if the update broke
the server for every client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WGAYpQgXt95LdDQcJYgjB8
---
 test/test.cc | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/test/test.cc b/test/test.cc
index 98ad3cc1..eaf096e5 100644
--- a/test/test.cc
+++ b/test/test.cc
@@ -16144,32 +16144,31 @@ void ClientCertMissing(const ClientCertServerSetup &setup = nullptr) {
 
 TEST(SSLClientServerTest, ClientCertMissing) { ClientCertMissing(); }
 
-// A server that requires client certificates must keep requiring them after a
-// verify callback is set on its context, or set and then cleared again.
-void ClientCertStillRequired(bool clear_callback) {
-  auto setup = [clear_callback](SSLServer &svr) {
-    ASSERT_TRUE(tls::set_verify_callback(
-        svr.tls_context(), [](const tls::VerifyContext &) { return true; }));
-    if (clear_callback) {
-      ASSERT_TRUE(tls::set_verify_callback(svr.tls_context(), nullptr));
-    }
-  };
+// A server that requires client certificates must keep requiring them after
+// setup changes it, and keep accepting a client that has one
+void ClientCertStillRequired(const ClientCertServerSetup &setup) {
   ClientCertMissing(setup);
   ClientCertPresent(CLIENT_CERT_FILE, CLIENT_PRIVATE_KEY_FILE, std::string(),
                     setup);
 }
 
 TEST(SSLClientServerTest, ClientCertStillRequiredAfterVerifyCallbackSet) {
-  ClientCertStillRequired(false);
+  ClientCertStillRequired([](SSLServer &svr) {
+    ASSERT_TRUE(tls::set_verify_callback(
+        svr.tls_context(), [](const tls::VerifyContext &) { return true; }));
+  });
 }
 
 TEST(SSLClientServerTest, ClientCertStillRequiredAfterVerifyCallbackCleared) {
-  ClientCertStillRequired(true);
+  ClientCertStillRequired([](SSLServer &svr) {
+    ASSERT_TRUE(tls::set_verify_callback(
+        svr.tls_context(), [](const tls::VerifyContext &) { return true; }));
+    ASSERT_TRUE(tls::set_verify_callback(svr.tls_context(), nullptr));
+  });
 }
 
-// Replacing the certificates must not stop the server requiring client ones
 TEST(SSLClientServerTest, ClientCertStillRequiredAfterUpdateCertsPem) {
-  ClientCertMissing([](SSLServer &svr) {
+  ClientCertStillRequired([](SSLServer &svr) {
     std::string cert_pem, key_pem, ca_pem;
     read_file(SERVER_CERT_FILE, cert_pem);
     read_file(SERVER_PRIVATE_KEY_FILE, key_pem);