Jabrique commented on PR #13373: URL: https://github.com/apache/trafficserver/pull/13373#issuecomment-4965414120
@bryancall Thanks for the thorough review. I've pushed an update that addresses all your points: Blocker addressed: - Fixed the hasAnyCert gate to explicitly check both storages: count(SSLCertContextType::RSA) > 0 || count(SSLCertContextType::EC) > 0. - Added Scenario F to the gold test. It generates an EC cert (prime256v1) and an RSA cert alongside a bad entry. Non-blocking points addressed: - Startup counter limitation: Both ssl.en.rst and records.yaml.en.rst now explicitly state that the counter only tracks failures from live traffic_ctl reloads. - Scenario D handshake: Added the missing curl step to verify that CN=sni-d.example.com is actually presented. - Previously-good SNI stops serving: I added a brand new Scenario G. It sets up an alpha SNI that is valid initially, but gets replaced with a bad entry on reload. The test asserts that alpha stops serving its old cert (falling back to the wildcard default), while beta continues serving correctly. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
