Enforce required TLS client certificates

[mbuckton]

What changed

• configure exactly one SSLEngine client-authentication mode
• give required client authentication precedence over optional authentication
• add regression coverage for all required/wanted combinations

Root cause

SSLEngine client-authentication setters override each other. Calling setWantClientAuth after setNeedClientAuth cleared the required setting, including when wanted was false.

Impact

TLS servers configured with clientCertificateRequired=true now retain mandatory client-certificate authentication and reject peers that do not provide an acceptable certificate.

Validation

Added unit assertions for disabled, wanted, required, and conflicting required/wanted configurations.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 68f7b511-6098-4e0b-b374-de33c9a8f651

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mbuckton]

Superseded by #464, rebuilt from the development branch with the broader TLS/CRL security fixes and regression coverage.