v3.1.14

Changelog

• 66a9ff3 Retain the receive replay cutoff across Resume
• 9365bfd Reject resumption of incomplete connection state
• 1b7dd0b Validate cookies before resuming server sessions
• 93a9fd1 Authenticate peers again on session resumption
• ff414eb Recheck PSK credentials before resuming sessions
• a470668 Preserve extended master secret on resumption
• 2b234cd Bind cached sessions to role and cipher suite
• ce84b97 Save sessions only after client authentication
• a3c7992 Backport ALPN selection validation
• fe06b60 Backport late plaintext alert validation
• ffac271 Count UDP connections before exposing them to Accept
• 0c3b8c4 Reject unsupported DTLS record epochs
• ec46cde Retransmit cookie challenges only for ClientHello retries
• a460d83 Select cipher suites using the SNI certificate
• ad3c3e0 Reject unrequested client certificates
• 7c42263 Check server certificate keys against the cipher suite
• 9d0557b Distinguish RSA-PSS certificate signature schemes
• a1332da Reject empty certificate entries
• 4a04e7c Bound SNI processing during certificate selection
• a4f3e27 Preserve IP server names for certificate verification
• 72b2865 Fix PSK identity-hint length overflow