moonchen opened a new pull request, #13712: URL: https://github.com/apache/trafficserver/pull/13712
With BoringSSL, a default entry containing RSA and EC certificates serves only the last certificate to clients with no SNI or an unknown SNI. Clients restricted to the other key type fail with `handshake_failure`, despite a compatible certificate being configured. After name and address lookups miss, select the existing `*` entry for the client’s key type. This reuses the entries maintained by certificate loading and secret updates; OpenSSL’s native dual-certificate selection is unchanged. A default `action: tunnel` entry on a transparent port also applies to these fallback clients. Add regression coverage for both certificate orders, RSA and ECDSA clients, TLS 1.2 and TLS 1.3, and absent, unknown, and matching SNI. The original callback fails the regression with alert 40; the fix passes it with BoringSSL and preserves OpenSSL behavior. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
