Jira (PUP-10154) Detect connection errors when using TLS 1.3 and using post-handshake authentication

[Josh Cooper (JIRA)]

Title: Message Title

Josh Cooper updated an issue   Puppet / PUP-10154 Detect connection errors when using TLS 1.3 and using post-handshake authentication Change By: Josh Cooper Prior to TLS 1.3, the client always sends it its certificate (if it has one) during the TLS handshake. As a result, the {{OpenSSL::SSL::SSLSocket#connect}} method only returns success if the server accepted our client cert (or we didn't have one) . This way we can differentiate between connection errors and other types of errors, like HTTP 302, when processing our server list, finding a suitable server using SRV, etc. When using TLS 1.3, the client cert *may* be sent after the server completes its side of the TLS handshake. This is referred to as post handshake authentication. This means the client won't know if the server accepted its client cert until after {{SSLSocket#connect}} returns and we try to send application data. If the server rejected our cert, then we'll get a {{ECONNRESET}}. It also appears TLS 1.3 can send the client during the handshake (it was on by default in openssl 1.1.0, but [changed to opt-in in 1.1.1|https://github.com/openssl/openssl/pull/6938]) to reduce the number of TLS packages that are needed to connect/resume. It appears ruby hardcodes the use of {{post_connection_auth}}. See [https://github.com/ruby/openssl/pull/239] However that version of ruby-openssl hasn't been promoted into any branch of ruby yet. If there was a way to set disable that extension via {{Net::HTTP}} then we wouldn't need to account for the different protocol behaviors. Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.337392.1575326015000.13394.1578351000123%40Atlassian.JIRA.