v0.9.2

Added

• A warning when expected_sni names a host the certificate does not cover. The SNI gate admits exactly the configured names, and a name the certificate cannot vouch for is one no client that verifies the certificate by it can complete a handshake under: a typo there makes the server silent, and silence is what the gate is for, so nothing else would ever say so. Config::warnings now checks every configured name against the leaf certificate with rustls's own verify_server_name, the check a client makes, at startup, on --check-config and on every reload. It is a warning rather than an error because the list and the certificate are allowed to differ: a client pinning the certificate by fingerprint need not verify its name.

Testing

• Two unit tests mint a certificate and assert the warning for a misspelt name and its absence for a covered one in any letter case and with a trailing dot; the first goes red when the check is stubbed out.

Upgrading: nothing to do. Servers with expected_sni set may log one new warning at startup if a configured name is not on the certificate; that warning is the point of this release.

---

Static musl builds for x86_64 and aarch64. Verify with SHA256SUMS.

Each archive carries the binary, LICENSE, README.md and the script/ and docs/ directories. Installing and updating is described in docs/deployment.md.

Full Changelog: v0.9.1...v0.9.2