You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
ImprovementsKind: in v2.1.232,
ImprovementsSection of the release
What
mTLS material must now be a regular file, under a size cap, and contain a complete PEM block. A truncated or oversized file is ignored with an error log rather than partly loaded, and a certificate and key that do not match each other are also ignored.
Details
The check catches a file being read mid-rotation, where the certificate has been replaced but the key has not.
Evidence
mTLS: Ignoring incomplete
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
