Oliver Kieselbach 5dae21968b Client-certificate chain building never downloads an issuer ...

The platform forwards whatever certificate the TLS client presented, so an
unauthenticated caller can hand in a leaf signed by a CA it made up. The
chain engine then fetched the leaf's AIA caIssuers URL before rejecting it:
an attacker-directed GET from the backend, and a worker blocked for the
10 s retrieval timeout. Every legitimate issuer is embedded and Intune
certificates carry no AIA, so downloads are now disabled and the unused
retrieval timeout is gone.

The regression test signs a leaf with a CA that is neither embedded nor
sent and asserts that the listener behind its AIA URL sees no connection;
a self-signed leaf never reaches that path.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-28 09:06:09 +02:00

..

Agent

feat(agent): Delivery Optimization geo endpoint as last-resort geolocation provider

2026-09-25 17:08:56 +02:00

Backend

Client-certificate chain building never downloads an issuer

2026-09-28 09:06:09 +02:00

McpServer

Tenant configuration has one conditional write path; the full-model PUT is gone

2026-09-27 20:11:56 +02:00

Shared

Tenant configuration has one conditional write path; the full-model PUT is gone

2026-09-27 20:11:56 +02:00

Web

Tenant configuration has one conditional write path; the full-model PUT is gone

2026-09-27 20:11:56 +02:00