Document mTLS revocation checking when the client certificate's issuer is unavailable - #659
Conversation
…cate's issuer is unavailable Harper now resolves the issuer from its configured certificate authorities when the connection does not carry it (resumed TLS sessions, Node.js 26.8.0/26.8.1), and otherwise applies failureMode instead of silently skipping the check. Companion to HarperFast/harper#2380. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the certificate verification documentation to explain the behavior when an issuer certificate is unavailable, particularly during resumed TLS sessions or when using specific Node.js versions. It also adds troubleshooting steps for the associated warning. The review feedback suggests placing the <VersionBadge> component on a new line below the heading rather than inline, and breaking down the description of the security fallback behaviors into separate, distinct sentences to improve readability and scannability.
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-659 This preview will update automatically when you push new commits. |
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-659 This preview will update automatically when you push new commits. |
🧹 Preview CleanupThe preview deployment for this PR has been removed. |
2 participants
Documents the new behavior when a client certificate's issuer is unavailable to mTLS revocation checking: Harper resolves it from the configured certificate authorities, and otherwise applies
failureMode(rejected underfail-closed, allowed underfail-open) with a warning, instead of silently skipping the check. Adds the requirement that the issuing CA be configured on Harper for revocation checking on resumed TLS sessions and behind chain-forwarding proxies, plus a troubleshooting entry for the new warning.Companion to HarperFast/harper#2457 (fixes HarperFast/harper#2380). Version badge assumes the fix ships in v5.3.0 (the PR's milestone); adjust if it is backported.
🤖 Generated with Claude Code