Repository navigation

Reject mTLS clients whose revocation status cannot be checked under fail-closed, and recover the issuer from Harper's trusted CAs when the socket chain lacks it - #2457

Merged

kriszyp merged 2 commits into

mainfrom

kris/2380-no-issuer-fail-closed

Sep 2, 2026

Commits on Sep 1, 2026
- Reject mTLS clients whose revocation status cannot be checked under fail-closed, and recover the issuer from Harper's trusted CAs when the socket chain lacks it
  
  kriszyp
  and
  claude
  committed
  c5443f8
- Never resolve a certificate as its own issuer, skip republishing an unchanged CA set, and drop sinon from the new unit tests
  
  kriszyp
  and
  claude
  committed
  b1490fa