crypto/tls

ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in supportedVersions [1.24 backport]CherryPickCandidate

#73118 opened 23 hours ago by gopherbot

disable SHA-1 signature algorithms in TLS 1.2LibraryProposalProposalProposal-Crypto

#72883 opened 2 weeks ago by FiloSottile

extend coverage of BoGo test suiteImplementation

#72006 opened 1 month ago by cpu

add GetEncryptedClientHelloKeys callbackBugReportNeedsInvestigationProposal

#71920 opened 1 month ago by mholt

consider enforcing KU bits on leaf certsLibraryProposalNeedsDecision

#71842 opened 1 month ago by rolandshoemaker

missing "configForClient.mutex.RUnlock()" in "Config.ticketKeys(configForClient *Config)" funcBugReportNeedsInvestigation

#71655 opened 1 month ago by wamshawn

alertError not wrapped in exported AlertErrorBugReportNeedsInvestigation

#71500 opened 2 months ago by tobyjwebb

support encrypt_then_mac extensionLibraryProposalProposalProposal-Crypto

#71221 opened 2 months ago by xq2248

ClientHelloOuter should hide the actual ALPN listBugReportNeedsInvestigation

#71220 opened 2 months ago by rthellend

add support for NIST curve based ML-KEM hybridsLibraryProposalProposalProposal-Crypto

#71206 opened 2 months ago by tomato42

map boringssl errors to go errors in BoGo shim configNeedsFix

#71066 opened 3 months ago by rolandshoemaker

VerifyClientCertIfGiven with "bad" client certificateNeedsInvestigation

#70783 opened 3 months ago by yelkabetz

TestGetClientCertificate/TLSv13 failuresNeedsInvestigation

#70650 opened 4 months ago by gopherbot

TestHandshakeClientECDHEECDSAAESGCM/TLSv12 failuresNeedsInvestigation

#70648 opened 4 months ago by gopherbot

TestFIPSCertAlgs failuresNeedsInvestigation

#70618 opened 4 months ago by gopherbot

support AEGIS (for TLS 1.3)ProposalProposal-Crypto

#70587 opened 4 months ago by ydnar

re-enable two TLS tests with fips140tls.RequiredNeedsFix

#70505 opened 4 months ago by cpu

interoperability problems between go tls server and microsoft/outlook.com tls (smtp starttls) clientNeedsInvestigation

#70232 opened 4 months ago by mjl-

should apply default NextProtos to the result of GetConfigForClientNeedsInvestigation

#70214 opened 4 months ago by xinst

unrecognized failuresNeedsInvestigation

#68801 opened 7 months ago by gopherbot

TestVerifyConnection/TLSv13 failuresNeedsInvestigation

#68660 opened 8 months ago by gopherbot

support for checking certificate chains against CRL revocationProposalProposal-Crypto

#68573 opened 8 months ago by macb2625

TestCrossVersionResume/TLSv12 failuresNeedsInvestigation

#68564 opened 8 months ago by gopherbot

SCTs increment by one byte on resume during tls 1.0, tls 1.1, and 1.2 BoringSSL OnResume testsNeedsInvestigation

#68516 opened 8 months ago by monkwire

TestResumptionKeepsOCSPAndSCT/TLSv12 failuresNeedsInvestigation

#68461 opened 8 months ago by gopherbot

BenchmarkHandshakeServer/RSA failuresNeedsInvestigation

#68441 opened 8 months ago by gopherbot

TestTLS13OnlyClientHelloCipherSuite/some_TLS_1.2_cipher failuresNeedsInvestigation

#68435 opened 8 months ago by gopherbot

TestCrossVersionResume/TLSv13 failuresNeedsInvestigation

#68430 opened 8 months ago by gopherbot

BenchmarkHandshakeServer/ECDHE-P521-ECDSA-P521/TLSv12 failuresNeedsInvestigation

#68429 opened 8 months ago by gopherbot

BenchmarkHandshakeServer/ECDHE-P256-RSA failuresNeedsInvestigation

#68427 opened 8 months ago by gopherbot

BenchmarkHandshakeServer/ECDHE-X25519-ECDSA-P256/TLSv12 failuresNeedsInvestigation

#68425 opened 8 months ago by gopherbot

BenchmarkHandshakeServer/ECDHE-P256-ECDSA-P256 failuresNeedsInvestigation

#68422 opened 8 months ago by gopherbot

BenchmarkHandshakeServer/ECDHE-P256-RSA/TLSv12 failuresNeedsInvestigation

#68421 opened 8 months ago by gopherbot

BenchmarkHandshakeServer failuresNeedsInvestigation

#68418 opened 8 months ago by gopherbot

do not enforce legacy_record_version while reading TLS 1.3 recordsNeedsInvestigation

#67910 opened 9 months ago by avened

darwin race builders failing on BenchmarkHandshakeServer/ECDHE-X25519-ECDSA-P256NeedsInvestigation

#67748 opened 10 months ago by thanm

bogo suite on Windows is flakeyNeedsInvestigationOS-Windows

#66913 opened 11 months ago by rolandshoemaker

TestBogoSuite failuresNeedsInvestigation

#66910 opened 11 months ago by gopherbot

implement RFC5929 tls-server-end-point supportProposalProposal-Crypto

#65047 opened 1 year ago by Neustradamus

dynamically reload root certificate authoritiesProposalProposal-Crypto

#64796 opened 1 year ago by p0lyn0mial

add RemoteAddr to ConnectionState structProposalProposal-Crypto

#64782 opened 1 year ago by shlomor25

server doesn't check for empty legacy_session_id when doing QUIC session resumptionNeedsInvestigation

#63936 opened 1 year ago by marten-seemann

Large session tickets in Go 1.21 can cause Windows Schannel clients to be unable to connectNeedsInvestigationOS-WindowsSecurity

#63763 opened 1 year ago by printfn

don't require Config to set MinVersion = TLS13 when using QUICNeedsFix

#63722 opened 1 year ago by marten-seemann

Allow setting SignatureSchemes in ConfigProposalProposal-Crypto

#63527 opened 1 year ago by Thomas717-Ether

broken link in Config.KeyLogWriter docs DocumentationNeedsInvestigation

#63331 opened 2 years ago by rhysh

SNI name with trailing dot (absolute name) fails tls handshakeNeedsInvestigation

#63117 opened 2 years ago by mjl-

QUICConn.SendSessionTicket should check Config.SessionTicketsDisabledNeedsFix

#62032 opened 2 years ago by marten-seemann

ClientHelloInfo.Conn field is nil (or return value of RemoteAddr())NeedsInvestigation

#61639 opened 2 years ago by high3eam

add Config.AdditionalServerNamesProposalProposal-Crypto

#61483 opened 2 years ago by andrewhodel

support for openssl ciphers symbols, keywords in tls configProposalProposal-Crypto

#60878 opened 2 years ago by vkosuri

session resumption fails with a cloned tls.ConfigNeedsInvestigation

#60506 opened 2 years ago by marten-seemann

avoid linkability across sessions by not reusing session ticketsNeedsInvestigation

#60505 opened 2 years ago by marten-seemann

advanced sessions APIsProposalProposal-AcceptedProposal-Crypto

#60105 opened 2 years ago by FiloSottile

new option for mTLS servers to not advertise acceptable certificate_authoritiesProposalProposal-Crypto

#59825 opened 2 years ago by irsl

centralize alert sendingNeedsInvestigation

#59773 opened 2 years ago by rolandshoemaker

cannot enforce "h2" with ALPNNeedsInvestigation

#59734 opened 2 years ago by jfgiorgi

remote error: tls:internal errorNeedsInvestigation

#58434 opened 2 years ago by zhaozuowu

support RFC8998 SM3NeedsDecisionProposal-Crypto

#54087 opened 2 years ago by xuweiguo

TLS 1.3 unable to disable non-NIST approved ChaCha20 Cipher SuiteNeedsInvestigation

#54072 opened 2 years ago by upsampled

don't include supported_versions extension if MaxVersion < 1.3 NeedsInvestigation

#53384 opened 2 years ago by jameshartig

consider less allocations for Conn.ReadNeedsInvestigationPerformance

#53142 opened 2 years ago by TriAnMan

be more specific about errors `bad record MAC`NeedsInvestigation

#51837 opened 3 years ago by OO00O0O

abort handshake if unrequested extensions are sentNeedsInvestigation

#51090 opened 3 years ago by aarongable

the whole http body is read, but an Unexpected EOF is return at the same timeNeedsInvestigation

#49422 opened 3 years ago by Jarvis-Zhou

wrap handshake errorsNeedsInvestigation

#48151 opened 3 years ago by ptagrawal

TLS connections use small buffer size that results in small syscalls and ignore HTTP client transport buffer sizesNeedsInvestigation

#47672 opened 3 years ago by richardartoul

missing alpnprotocol field's value of the message which SSL/TLS protocol's handshake phase sends back.NeedsInvestigation

#45918 opened 3 years ago by lynnyuan-arch

tls.Conn.Close sends unnecessary close_notify if the underlying connection was already closedNeedsInvestigation

#45709 opened 4 years ago by ameshkov

Conn.Close should not override user's write deadlineNeedsInvestigation

#45162 opened 4 years ago by kozlovic

support kernel-provided TLSProposalProposal-AcceptedProposal-Crypto

#44506 opened 4 years ago by howardjohn

Conn.rawInput buffer has no chance to shrink on large number of idle connsNeedsInvestigation

#43563 opened 4 years ago by cch123

Sending multiple messages via tcp4 connection encrypted by TLS1.3 doesn't workNeedsInvestigation

#43250 opened 4 years ago by nixargh

add support for Certificate Compression (RFC 8879)FeatureRequestNeedsDecision

#42967 opened 4 years ago by marten-seemann

performance slow on windows/386NeedsInvestigationOS-Windows

#40575 opened 4 years ago by RichardLaos

support TLS 1.3 post-handshake authenticationProposalProposal-CryptoProposal-Hold

#40521 opened 4 years ago by skyfmmf

TLS handshake issue with Eclipse Paho MQTT client and RabbitMQNeedsInvestigation

#40273 opened 4 years ago by adeveloper87

cleanup handshake stateNeedsFix

#39406 opened 4 years ago by FiloSottile

RFC 7685 support (ClientHello "padding(21)")NeedsInvestigationProposalProposal-Crypto

#39271 opened 4 years ago by MarkOtzen

conflicting lock order in Handshake() and Read()NeedsInvestigation

#38870 opened 4 years ago by BurtonQin

Client Side TLS Authentication fails for certs with long fieldsNeedsInvestigation

#36467 opened 5 years ago by antevens

improve server-side (lack of) renegotiation docs and error messageDocumentationNeedsFixhelp wanted

#36285 opened 5 years ago by gitstashpop

add docs detailing the sequence before/after Read()/Write() during TLS handshakeDocumentationNeedsInvestigation

#36128 opened 5 years ago by martindg

add support for exported authenticatorsProposalProposal-CryptoProposal-Hold

#35758 opened 5 years ago by tatianab

improve default performance of SupportsCertificateNeedsDecisionPerformance

#35504 opened 5 years ago by FiloSottile

add support for delegated credentialsProposalProposal-CryptoProposal-Hold

#35311 opened 5 years ago by aaslamin

expose TLS alert type for more precise error checksFeatureRequestNeedsInvestigationProposalProposal-Crypto

#35234 opened 5 years ago by TheHackerDev

TestDynamicRecordSizingWithStreamCipher timeout on darwin-amd64-10_12 builderNeedsInvestigationOS-Darwin

#34735 opened 5 years ago by bcmills

Dial error message does not give much contextNeedsInvestigation

#34197 opened 5 years ago by hramrach

error with client certificate and X448 and X25519 curvesNeedsInvestigation

#33577 opened 5 years ago by cromefire

make it clear that implementation is compliant with RFC 5246DocumentationNeedsFix

#32079 opened 5 years ago by ALTree

incompatibility with Trust Settings in CA certificateNeedsInvestigation

#31881 opened 5 years ago by kruftik

safely shutdownNeedsInvestigation

#29462 opened 6 years ago by kazzmir

test

#28976 opened 6 years ago by bcmills

add support for AES-CCMProposalProposal-CryptoProposal-Hold

#27484 opened 6 years ago by igolaizola

fix pseudo-constant mitigation for lucky 13NeedsInvestigation

#27071 opened 6 years ago by dgryski

GetCertificate called on resumed sessionsNeedsInvestigation

#25352 opened 6 years ago by FiloSottile

implement Session IDs resumptionProposalProposal-CryptoProposal-Hold

#25228 opened 7 years ago by pvoicu

provide a way to access local certificate used to set up a connectionProposalProposal-Crypto

#24673 opened 7 years ago by lyuxuan

implement OCSP Must-StapleNeedsFixProposal-AcceptedProposal-Cryptohelp wanted

#22274 opened 7 years ago by nhooyr

customisable max TLS record sizeNeedsFixProposal-AcceptedProposal-Crypto

#20420 opened 7 years ago by 925dk

slow server-side handshake performance for RSA certificates without client session cachePerformancehelp wanted

#20058 opened 8 years ago by valyala

Dial returns io.EOFNeedsDecision

#19874 opened 8 years ago by joneskoo

Set{Read,Write}Deadline implementation is surprising/ineffectiveNeedsInvestigation

#13828 opened 9 years ago by rburchell

Disable CBC Ciphers by defaultSecurity

#13385 opened 9 years ago by pquerna

a timeout error on tls.Conn.Write is confusingNeedsDecision

#8071 opened 11 years ago by mikioh

tls.Dial get error "local error: unexpected message"NeedsInvestigation

#7953 opened 11 years ago by gopherbot

needs a convenience function for reading encrypted keysNeedsInvestigation

#6722 opened 11 years ago by gopherbot

add PSK supportFeatureRequestNeedsDecisionProposal-Crypto

#6379 opened 11 years ago by gopherbot