You'll notice
Useful2 Signal2
Client certificates and keys are size- and format-checked, and mismatched pairs are ignored.
What's wrong with this entry?
Anonymous. No account, no email.
What
mTLS material must now be a regular file, under a size cap, and contain a complete PEM block. A truncated or oversized file is ignored with an error log rather than partly loaded, and a certificate and key that do not match each other are also ignored.
Details
- The check catches a file being read mid-rotation, where the certificate has been replaced but the key has not.
Evidence
mTLS: Ignoring incomplete
Strings lifted out of the shipped bundle, so the claim above can be checked against them.