mirror of
https://github.com/openziti/ziti.git
synced 2026-09-10 00:35:41 +00:00
Paul Lorenz
d84e78ec59
- fingerprints only the leaf certificate whose key the TLS handshake proved possession of when verifying a dialing router on an incoming link, instead of the whole presented certificate chain - prevents an enrolled router from being admitted on a link under another router's identity by presenting that router's certificate as filler in its chain - adds a unit test covering leaf-only fingerprinting, including the case where a filler certificate must not contribute a fingerprint