Fluksio/app
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Do not check a pinned certificate's dates
Docs / docs (push) Successful in 32s
Details
Playwright Tests / test-playwright (1, 2) (push) Failing after 6m58s
Details
Playwright Tests / test-playwright (2, 2) (push) Failing after 2m33s
Details
pre-commit / pre-commit (push) Failing after 3m1s
Details
Test Backend / test-backend (push) Failing after 3m13s
Details
Compose Smoke Test / test-compose (push) Successful in 31s
Details
Playwright Tests / merge-reports (push) Successful in 1m34s
Details

Browse Source 
A pin trusts one exact certificate, so an expired one or an engine clock
that is off no longer locks a device out (X509_V_FLAG_NO_CHECK_TIME).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
This commit is contained in:
stroblme
2026-10-07 10:11:08 +02:00
co-authored by Claude Opus 5.5
parent c954a0ab6d
commit 38013a0774
3 changed files with 117 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/connector-contract.md
+3
View File
@@ -266,6 +266,9 @@ except httpx.ConnectError as exc:
- Any other certificate is refused in the handshake, before a key or a command
is sent. `raise_if_changed` turns that refusal into `CertificateChanged`,
which names the new SHA-256 and the key to clear, under the node type given.
- The pinned certificate's dates are not checked: a pin trusts that exact
certificate, so one that expired, or an engine clock that is off, does not
lock the device out.
- Clearing the key accepts whatever the device presents next.
## Lifecycle