agent-substrate / agent-substrate/substrate
atunnel: refresh client CA pool per handshake
未關閉
area/network
kind/feature
- 主要語言
- Go
- 星號
- 1.8k
- 分支
- 316
- 平均合併
- 2 天 43 分鐘
- 30 天內合併 PR
- 287
描述
In `internal/atunnel/server.go` the client CA pool is built once at startup, while leaf certificates are reloaded per connection. Because substrate certs expire within ~1–2 days, a frozen CA pool means the server will eventually reject valid peers (or keep trusting a rotated-out CA) until it restarts.
Implement tls.Config.GetConfigForClient so the client CA pool is re-read on each handshake, mirroring the existing per-connection leaf cert reload.
source: https://github.com/agent-substrate/substrate/pull/559#discussion_r3687538721
貢獻指南
評估
這個 Issue 還沒有評估資料。