diff options
| author | omnom62 <omnom62@outlook.com> | 2026-09-02 20:21:38 +1000 |
|---|---|---|
| committer | omnom62 <omnom62@outlook.com> | 2026-09-02 20:21:38 +1000 |
| commit | 71ea2f3d9f654f1b3ab9e08fa6cdff4447b3fc0a (patch) | |
| tree | d2e1453a1c44e389bdb8a69f28e868dc758cc661 /src/migration-scripts/ssh | |
| parent | 99decdac737629507b88c4d0390344a981a181ab (diff) | |
| download | vyos-1x-71ea2f3d9f654f1b3ab9e08fa6cdff4447b3fc0a.tar.gz vyos-1x-71ea2f3d9f654f1b3ab9e08fa6cdff4447b3fc0a.zip | |
http-api: T8989: fix mTLS trust boundary to selected CA only
Writing only the configured CA certificate to the nginx ssl_client_certificate
trust bundle instead of the full chain up to the root CA. Using find_chain()
would include the root CA, allowing sibling intermediates under the same root
to authenticate. This restricts the mTLS trust boundary to certificates issued
directly by the configured CA.
Diffstat (limited to 'src/migration-scripts/ssh')
0 files changed, 0 insertions, 0 deletions