yhirose fcf7568230 Complete server certificate updates on every backend ...

OpenSSL allowed client-initiated renegotiation, which runs a handshake
update_certs_pem() does not wait for, and kept sessions and ticket keys
across a change of client CAs, so a client verified under the old ones
could resume. wolfSSL added new client CAs to the old instead of
replacing them, and a bad certificate or key left Mbed TLS and wolfSSL
half updated.

Turn renegotiation off, forget the sessions and ticket keys on a client
CA change, replace wolfSSL's CAs, and check new material before swapping
it in. Note that the update must not be called from a TLS callback.

2026-10-16 16:39:00 -04:00

..

pages

Complete server certificate updates on every backend

2026-10-16 16:39:00 -04:00

config.toml

Release v0.61.0

2026-10-13 22:56:02 -04:00