{"version":"2.1.232","anchor":"client-certificate-and-key-files-are-checked-before-being-lo","canonical_anchor":"client-certificate-and-key-files-are-checked-before-being-lo","heading":"Client certificate and key files are checked before being loaded","tier":"notice","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232\/e\/client-certificate-and-key-files-are-checked-before-being-lo","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232","markdown":"### Client certificate and key files are checked before being loaded\n\nClient certificates and keys are size- and format-checked, and mismatched pairs are ignored.\n\n**What**\n\nmTLS material must now be a regular file, under a size cap, and contain a complete PEM block. A truncated or oversized file is ignored with an error log rather than partly loaded, and a certificate and key that do not match each other are also ignored.\n\n**Details**\n\n- The check catches a file being read mid-rotation, where the certificate has been replaced but the key has not.\n\n**Evidence**\n\n`mTLS: Ignoring incomplete `\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}