Harden the EST/SCEP server, CA store and HTTP client - #25

Open

Frauschi wants to merge 18 commits into

wolfSSL:mainfrom

Frauschi:fenrir

Commits on Sep 11, 2026

Reject an EST listener configured without a TLS identity
Frauschi
committed
643f33f
http: keep IPv6 literals bracketed in origins and Host headers
Frauschi
committed
204c701
Carry every CSR subject RDN into the issued certificate
Frauschi
committed
e75492b
Fail server startup when the CA store cannot be read or written
Frauschi
committed
766eb8a
Interrupt an idle accepted connection on server stop
Frauschi
committed
65e2289
Verify the stored CA certificate matches the stored CA key
Frauschi
committed
308cc04
Bound the non-blocking read to the remaining response allowance
Frauschi
committed
41a1a9b
Stop the URL authority scan at a query or fragment
Frauschi
committed
b8f6c5b
Assert keyUsage on the generated self-signed CA certificate
Frauschi
committed
cc97254
Report CA-store read and rollback failures as themselves
Frauschi
committed
be7e9ce
Bound server I/O by shutdown, not by which direction stalled
Frauschi
committed
7f6c39d
Pin the givenName drop between CSR and issued certificate
Frauschi
committed
85ed9be
Gate the server tests on the server, not on a protocol
Frauschi
committed
6de13dd
Carry street and the string encoding into the issued certificate
Frauschi
committed
eaee403
Mark basicConstraints critical on the generated CA
Frauschi
committed
5bfce12
Correct three RFC citations and drop the restated contracts
Frauschi
committed
3ceaea7
Share the helpers that had grown second copies
Frauschi
committed
475452f
Address the non-blocking review points
Frauschi
committed
54cd99f