mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-10-19 11:19:36 +00:00
yhirose
fcf7568230
OpenSSL allowed client-initiated renegotiation, which runs a handshake update_certs_pem() does not wait for, and kept sessions and ticket keys across a change of client CAs, so a client verified under the old ones could resume. wolfSSL added new client CAs to the old instead of replacing them, and a bad certificate or key left Mbed TLS and wolfSSL half updated. Turn renegotiation off, forget the sessions and ticket keys on a client CA change, replace wolfSSL's CAs, and check new material before swapping it in. Note that the update must not be called from a TLS callback.