Ingela/ssl/hardening/otp 20289 - #11478
Merged
IngelaAndin merged 17 commits intoAug 24, 2026
Merged
Conversation
Contributor
CT Test Results 2 files 67 suites 25m 18s ⏱️ Results for commit b275ec5. ♻️ This comment has been updated with latest results. To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass. See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally. Artifacts
// Erlang/OTP Github Action Bot |
IngelaAndin
force-pushed
the
ingela/ssl/hardening/OTP-20289
branch
25 times, most recently
from
August 17, 2026 07:26
28409be to
ee66261
Compare
IngelaAndin
force-pushed
the
ingela/ssl/hardening/OTP-20289
branch
2 times, most recently
from
August 21, 2026 12:23
2f0e284 to
e687c9a
Compare
IngelaAndin
added
the
testing
IngelaAndin
force-pushed
the
ingela/ssl/hardening/OTP-20289
branch
from
August 21, 2026 13:40
e687c9a to
afc326f
Compare
u3s
previously approved these changes
Aug 21, 2026
Add missing format_status function to avoid unwanted logging. Also use new format_staus/1 instead of deprecated format_status/2.
Add sanity checks. Correct documentation for logging. Ignore invalid CRL input.
Avoid bignums and floats.
Handle termination of clients that locked a ticket for PSK resumption attempt when using automated client ticket store.
By default run TLS-1.3 instead of TLS-1.2, but keep TLS-1.2 support for smoother upgrade. Make sure net_kernel allowed is honored in all cases.
Add missing state update Could cause connection failure instead of DTLS alert ignoring. Fix fragment reassembling bug and handle unexpected epoch 0 message. Mitigate DoS attack possiblities.
Correct TLS-1.3 ALPN check. Add missing client santity check. Various MUST alerts for extension handling.
Better safe guard, try of to narrow here.
Ensure signature algs are checked for intermediates. If user hade own verify fun these would previously be missed. Add missing extension assertion.
Refocus on what parts are not yet implemented instead of trying to list everthing that is. Add note about importance of using lates patch version.
…phr_spec messages Found when looking into issue 11075
IngelaAndin
force-pushed
the
ingela/ssl/hardening/OTP-20289
branch
2 times, most recently
from
August 22, 2026 19:52
a8c7889 to
6efa8bf
Compare
dgud
reviewed
Aug 24, 2026
Make session_reuse disabled by default when client certificates are requierd, until extend master secret can be implemented. But best option is to run TLS-1.3.
IngelaAndin
force-pushed
the
ingela/ssl/hardening/OTP-20289
branch
from
August 24, 2026 06:37
6efa8bf to
b275ec5
Compare
dgud
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Some hardening commits planed to backport to supported relases.