Maurus Cuelenaere 5806c80e6a fix(websecure): cap serial numbers at 128 bits for Apple TLS clients (#1453) ...

The 4096-bit limit produced ~500-byte serials that violate RFC 5280
§4.1.2.2's 20-octet cap. Apple's DER parser enforces this strictly,
so URLSession, NWConnection, AVFoundation and every other client on
macOS/iOS/tvOS rejected the cert with "Unknown format in import"
before any trust evaluation ran.

Lower the limit to 128 bits (matching Go stdlib's generate_cert.go
example) and add a one-shot migration that drops any already-baked
oversized CA, plus the leaves it issued, on startup so existing
devices recover without manual SSH cleanup.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-12 09:44:16 +02:00

..

ed25519_test.go

feat(websecure): add support for ed25519 certificates (#513)

2025-05-25 11:09:58 +02:00

log.go

feat(tls): #330

2025-04-11 00:43:58 +02:00

selfsign.go

feat(tls): #330

2025-04-11 00:43:58 +02:00

store.go

fix(websecure): cap serial numbers at 128 bits for Apple TLS clients (#1453)

2026-05-12 09:44:16 +02:00

utils.go

fix(websecure): cap serial numbers at 128 bits for Apple TLS clients (#1453)

2026-05-12 09:44:16 +02:00