Pin QUIC fabric endpoint certificates

2026-05-16 10:51:06 +03:00
parent 3386a5e9b2
commit 4ebc6629e6
6 changed files with 157 additions and 18 deletions
@@ -313,6 +313,9 @@ compatibility candidates for fabric sessions.
 VPN fabric-session gateway transport now consumes ranked endpoint candidates,
 so dataplane sessions can select QUIC fast-path candidates and fall back to
 legacy peer endpoints when the control plane has not published candidates yet.
+The temporary self-signed QUIC listener advertises its SHA-256 certificate
+fingerprint in endpoint metadata, and the QUIC client can pin that fingerprint
+instead of disabling verification while the cluster CA path is being finished.

 Deliverables: