Fix server SSL context initialization - #6214
binaryfire wants to merge 2 commits into
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## 6.1 #6214 +/- ##
=======================================
Coverage 86.21% 86.22%
=======================================
Files 110 110
Lines 16790 16798 +8
Branches 2981 2980 -1
=======================================
+ Hits 14476 14484 +8
Misses 2314 2314 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Thank you for your PR! However, this scenario is not common in actual development. Since set() must be called before start(), all SSL configurations can be fully set up in a single call, making multiple calls unnecessary. If configuration adjustments are truly needed, you can simply modify the first set() call directly. |
binaryfire
changed the title
binaryfire
changed the title
Server Port set skipped SSL initialization when SNI certificates were configured without a default certificate. This left the primary context absent and the SNI callback unregistered, so every handshake failed before certificate selection. Always initialize the primary context and permit an empty primary certificate only after valid SNI contexts have been created. Continue rejecting incomplete certificate pairs.
SSLContext create reported success when a certificate could not be loaded and left a partial context behind on other failures. Callers then treated the context as ready and skipped complete initialization on retry. Return failure for invalid certificates and free and clear every context that does not finish initialization.
0f23c24 to
0b657ef
Compare
binaryfire
changed the title
|
@NathanFreeman You’re right that repeated |
|
Follow-up: This PR now also supports server TLS configurations that provide certificates only through SNI. It rejects invalid or incomplete certificate settings, and failed SSL context creation now clears the incomplete context so a later attempt starts cleanly. Tests cover SNI-only listeners, invalid default certificates, incomplete settings, and failed-context cleanup. |
2 participants
SNI-only server configuration skipped creation of the primary SSL context, so connections failed before SNI could select a certificate. Invalid default certificates were also reported as successfully initialized, and other creation failures left an incomplete context marked ready.
This always creates the primary context, allowing it to omit a certificate only when valid SNI certificates exist. Invalid or incomplete certificate configuration is rejected. Failed context creation now frees and clears the incomplete context so later attempts start cleanly.
The SNI-only and invalid-certificate regressions fail on unchanged 6.1 and pass with this change. Existing SNI and HTTPS server tests continue to pass.