bneradt opened a new issue, #13575: URL: https://github.com/apache/trafficserver/issues/13575
## Problem `TSSslClientCertUpdate` cannot update an outbound client certificate context created from the normal SNI configuration. `SSLConfigParams::getCTX` stores each client context in `top_level_ctx_map` under the resolved certificate path. `TSSslClientCertUpdate`, however, constructs its lookup key as `cert_path:key_path`. The keys therefore never match, including the common call `TSSslClientCertUpdate(cert_path, nullptr)` made by the example `cert_update` plugin. The API returns `TS_ERROR`, and later outbound TLS connections continue using the old context. ## Existing test false positive The existing `cert_update` AuTest exercises this path but reports PASS despite the defect. In a preserved passing sandbox: - `traffic.out` says `Failed to update client cert`. - The post-update request returns HTTP 502. - The OpenSSL output does not contain the expected replacement certificate subject. The test misses this because its shared `update.gold` check can match the earlier successful server-certificate update, while the client-certificate gold file uses a wildcard-only AuTest expression around `bob.com` that succeeds even when the text is absent. ## Expected behavior The API should find the configured client context using the same key used when that context is stored, replace it with the certificate currently at that path, and make the replacement certificate visible on the next outbound TLS handshake. The regression test should explicitly require the client update success message and the replacement certificate subject. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
