tls_check: re-land the opt-in TLS check that never reached main - #1301
Merged
Conversation
…osite
Opted into with a meta.json field:
"tls_check": true
It needs a TLS listener on :9000 reading /certs-tls, a directory mounted for
that entry alone. Nothing is measured; passing earns a badge on the HTTP/1.1
composite, and only there -- the check covers :8081-class HTTP/1.1 TLS, so a
badge earned on it must not follow the entry into h2 and h3 views it says
nothing about.
certificate rotation the pair at /certs-tls is replaced under a
running server; the new certificate must be
served without a restart and still answer.
Measured first: caddy, bun and h2o-mruby all
keep serving the old one.
rotation keeps serving 30 requests across the swap, all must succeed
SNI handshakes with a server name and without
session resumption reported, not required
close_notify closed at the TLS layer, not just the socket
vulnerability suite testssl.sh -U: Heartbleed, ROBOT, POODLE,
SWEET32, LUCKY13 and 14 more. HIGH or CRITICAL
fails.
the shared TLS checks certificate identity, TLS 1.3, AEAD, ALPN,
obsolete protocols and weak ciphers
The dedicated port and private directory are the point of the design: the
check rotates certificates under a running server, and doing that to the
shared /certs would move the ground under json-tls, static-tls and every h2
profile in the same run. /certs is verified byte identical across a run that
rotates twice.
aspnet-minimal opts in and implements it. RotatingCertificate re-reads the
pair when its mtime moves, behind Kestrel's ServerCertificateSelector, which
runs per handshake. 114 passed, 0 failed; rotation lands in 1s and 30/30
requests survive the swap.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-lands the
tls_checkwork from #1296, which merged but never reachedmain.What happened
#1296 was stacked on
feat/tls-validation(#1292) — I set that base to stop the two PRs showing the same diff twice. The timing then went wrong:mainas47b79d7c, and closedfeat/tls-validation— a branch whose PR had already closed 28 minutes earlierA squash merge collapses the branch into one new commit on
main; the branch itself is not fast-forwarded and its PR closes. So when #1296 landed on that branch afterwards, there was nothing left to carry it onward. It has been sitting infeat/tls-validationever since, merged and unreachable.That branch cannot simply be merged now either — it predates #1298, #1299 and #1300, so merging it would revert the gRPC streaming removal and the wtx/sark result restore.
This PR
The single
tls_checkcommit, cherry-picked onto currentmain. Same 8 files, nothing else moves:scripts/validate.sh— the opt-in section: certificate rotation, rotation-under-load, SNI, resumption, close_notify, the testssl vulnerability suite, on:9000with/certs-tlsscripts/gen_leaderboard_data.py— carries the verdict intometa.tlsChecksite/leaderboard/index.html— the gold badge, H1 composite onlyframeworks/aspnet-minimal/*—RotatingCertificate, the:9000listener,"tls_check": trueVerified on this branch
The parity count moved 522 → 530 because this branch sits on top of #1298/#1299 rather than beside them.
🤖 Generated with Claude Code