Faiyaz RahmanandFrancis Lavoie 8a6ab2b7bb caddytls: require a trust pool for client cert verification modes (#8394) ...

* caddytls: require a trust pool for client cert verification modes

Reject verify_if_given and require_and_verify without a trust pool so they stop falling back to system roots.

* Apply suggestion from @francislavoie

Signed-off-by: Francis Lavoie <lavofr@gmail.com>

---------

Signed-off-by: Francis Lavoie <lavofr@gmail.com>
Co-authored-by: Francis Lavoie <lavofr@gmail.com>

2026-11-10 09:09:17 +00:00

..

distributedstek

…

standardstek

…

acmeissuer_test.go

caddytls: keep ACME issuer network proxy after RebuildCertMagic (#8288)

2026-10-28 09:37:00 +00:00

acmeissuer.go

caddytls: keep ACME issuer network proxy after RebuildCertMagic (#8288)

2026-10-28 09:37:00 +00:00

automation_test.go

caddytls: Avoid default issuers for implicit tailscale policies (#7577)

2026-03-20 09:36:03 -06:00

automation.go

events: tell CertMagic which events are worth emitting (#8010)

2026-10-03 01:03:20 +10:00

capools_test.go

tls: add system and combined CA pool modules (#7406)

2026-04-06 01:13:34 +03:00

capools.go

tls: add system and combined CA pool modules (#7406)

2026-04-06 01:13:34 +03:00

certmanagers.go

chore: Add nolints to work around haywire linters (#7493)

2026-02-17 16:52:54 -07:00

certselection.go

Use slices.Contains to simplify code (#7039)

2025-05-31 12:03:06 -06:00

connpolicy_test.go

caddytls: validate curve and protocol names, compare protocol IDs (#8266)

2026-10-26 20:14:59 +00:00

connpolicy_verifyconnection_test.go

caddytls: require a trust pool for client cert verification modes (#8394)

2026-11-10 09:09:17 +00:00

connpolicy.go

caddytls: require a trust pool for client cert verification modes (#8394)

2026-11-10 09:09:17 +00:00

ech_dns_test.go

tls: add alpn to managed HTTPS records (#7653)

2026-05-10 13:10:29 +10:00

ech.go

caddytls: sync ech publication history to the ech configs (#8376)

2026-11-08 11:18:43 +00:00

fileloader.go

chore: fix lint errors from newer golangci-lint (#7958)

2026-08-25 13:12:10 +10:00

folderloader.go

chore: fix lint errors from newer golangci-lint (#7958)

2026-08-25 13:12:10 +10:00

internalissuer_test.go

caddypki: Add support for multiple intermediates in signing chain (#7057)

2025-12-03 11:30:00 -07:00

internalissuer.go

caddypki: Add support for multiple intermediates in signing chain (#7057)

2025-12-03 11:30:00 -07:00

leaffileloader_test.go

caddytls: clientauth: leaf verifier: make trusted leaf certs source pluggable (#6050)

2024-03-05 14:55:37 -07:00

leaffileloader.go

caddytls: wire up client_auth leaf verifier Caddyfile (#6772)

2025-06-09 08:18:36 -06:00

leaffolderloader_test.go

caddytls: clientauth: leaf verifier: make trusted leaf certs source pluggable (#6050)

2024-03-05 14:55:37 -07:00

leaffolderloader.go

caddytls: correct documentation of LeafFolderLoader (#7327)

2025-11-01 18:29:55 +03:00

leafpemloader_test.go

caddytls: clientauth: leaf verifier: make trusted leaf certs source pluggable (#6050)

2024-03-05 14:55:37 -07:00

leafpemloader.go

caddytls: wire up client_auth leaf verifier Caddyfile (#6772)

2025-06-09 08:18:36 -06:00

leafstorageloader.go

caddytls: clientauth: leaf verifier: make trusted leaf certs source pluggable (#6050)

2024-03-05 14:55:37 -07:00

matchers_test.go

caddytls: add not matcher for TLS handshakes (#8138)

2026-10-04 17:22:21 -04:00

matchers.go

caddytls: add not matcher for TLS handshakes (#8138)

2026-10-04 17:22:21 -04:00

ondemand.go

caddyhttp: Add MatchWithError to replace SetVar hack (#6596)

2024-11-04 23:18:50 +00:00

pemloader.go

chore: fix lint errors from newer golangci-lint (#7958)

2026-08-25 13:12:10 +10:00

sessiontickets.go

caddytls: fix TLS state races and ECH rotation retry (#7756)

2026-05-20 16:35:40 +10:00

storage_clean_test.go

caddytls: sync ech publication history to the ech configs (#8376)

2026-11-08 11:18:43 +00:00

storageloader.go

caddytls: Give a better error message when given encrypted private keys (#6591)

2024-09-25 06:00:48 -06:00

tls_wildcard_test.go

caddytls: avoid duplicate automation for wildcard-covered hosts (#7697)

2026-05-11 00:08:40 +10:00

tls.go

events: tell CertMagic which events are worth emitting (#8010)

2026-10-03 01:03:20 +10:00

values.go

Fix typo in TLS group x25519mlkem768

2025-03-03 10:26:42 -07:00

zerosslissuer.go

chore: Add nolints to work around haywire linters (#7493)

2026-02-17 16:52:54 -07:00