Skip to content

reject client initilaization and request when tls context cannot be loaded - #3972

Open
sbiscigl wants to merge 1 commit into
mainfrom
crt-tls-failure
Open

sbiscigl wants to merge 1 commit into
mainfrom
crt-tls-failure

Conversation

@sbiscigl

Copy link
Copy Markdown
Contributor

Description of changes:

When CRTHttpClient failed to set up TLS (for example an unreadable caFile, caPath or proxyCaFile), it marked itself bad but nothing checked that flag. It now refuses every request with a non-retryable INVALID_PARAMETER_COMBINATION error when it's bad, sets the flag on proxy TLS failures too, and CreateHttpClient now actually checks the client's operator bool instead of just checking for a null pointer. This is a behavior change for misconfigured clients only: a CRT client with an unreadable CA file now fails all requests.

Check all that applies:

  • Did a review by yourself.
  • Added proper tests to cover this PR. (If tests are not applicable, explain.)
  • Checked if this PR is a breaking (APIs have been changed) change.
  • Checked if this PR will not introduce cross-platform inconsistent behavior.
  • Checked if this PR would require a ReadMe/Wiki update.

Check which platforms you have built SDK on to verify the correctness of this PR.

  • Linux
  • Windows
  • Android
  • MacOS
  • IOS
  • Other Platforms

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@sbiscigl
sbiscigl marked this pull request as ready for review October 29, 2026 20:02
@sbiscigl
sbiscigl requested a review from sbaluja October 30, 2026 14:25

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants