Problem
TSSslClientCertUpdate cannot update an outbound client certificate context created from the normal SNI configuration.
SSLConfigParams::getCTX stores each client context in top_level_ctx_map under the resolved certificate path. TSSslClientCertUpdate, however, constructs its lookup key as cert_path:key_path. The keys therefore never match, including the common call TSSslClientCertUpdate(cert_path, nullptr) made by the example cert_update plugin. The API returns TS_ERROR, and later outbound TLS connections continue using the old context.
Existing test false positive
The existing cert_update AuTest exercises this path but reports PASS despite the defect. In a preserved passing sandbox:
traffic.out says Failed to update client cert.- The post-update request returns HTTP 502.
- The OpenSSL output does not contain the expected replacement certificate subject.
The test misses this because its shared update.gold check can match the earlier successful server-certificate update, while the client-certificate gold file uses a wildcard-only AuTest expression around bob.com that succeeds even when the text is absent.
Expected behavior
The API should find the configured client context using the same key used when that context is stored, replace it with the certificate currently at that path, and make the replacement certificate visible on the next outbound TLS handshake. The regression test should explicitly require the client update success message and the replacement certificate subject.
Problem
TSSslClientCertUpdatecannot update an outbound client certificate context created from the normal SNI configuration.SSLConfigParams::getCTXstores each client context intop_level_ctx_mapunder the resolved certificate path.TSSslClientCertUpdate, however, constructs its lookup key ascert_path:key_path. The keys therefore never match, including the common callTSSslClientCertUpdate(cert_path, nullptr)made by the examplecert_updateplugin. The API returnsTS_ERROR, and later outbound TLS connections continue using the old context.Existing test false positive
The existing
cert_updateAuTest exercises this path but reports PASS despite the defect. In a preserved passing sandbox:traffic.outsaysFailed to update client cert.The test misses this because its shared
update.goldcheck can match the earlier successful server-certificate update, while the client-certificate gold file uses a wildcard-only AuTest expression aroundbob.comthat succeeds even when the text is absent.Expected behavior
The API should find the configured client context using the same key used when that context is stored, replace it with the certificate currently at that path, and make the replacement certificate visible on the next outbound TLS handshake. The regression test should explicitly require the client update success message and the replacement certificate subject.