Add automatic TLS client certificate refresh support #732
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
EhabY
force-pushed
the
automatic-mtls-refresh
branch
3 times, most recently
from
e6ef17f to
871a6e4
Compare
EhabY
changed the title
EhabY
force-pushed
the
automatic-mtls-refresh
branch
from
871a6e4 to
bc732ea
Compare
johnstcn
reviewed
Jan 20, 2026
| */ | ||
| private async attemptCertificateRefresh(): Promise<boolean> { | ||
| if (!this.#options.onCertificateExpired) { | ||
| return false; |
Member
There was a problem hiding this comment.
suggestion: How about we log that the cert is expired and there's nothing we can do about it because we haven't been told how to refresh the client cert?
Collaborator
Author
There was a problem hiding this comment.
We actually always pass a handler in production so I'll just make it required (we can pass () => false if need be)
| ### Fixed | ||
|
|
||
| - Fixed `SetEnv` SSH config parsing and accumulation with user-defined values. | ||
| - Improved WebSocket error handling for more consistent behavior across connection failures. |
Collaborator
Author
There was a problem hiding this comment.
As mentioned in #732 (comment), this was always in issue but I only noticed it now when catching cert errors
…en they fail - New coder.tlsCertRefreshCommand setting to configure a refresh command (e.g., metatron refresh) - Detects 7 SSL/TLS client certificate alert codes: expired, revoked, bad certificate, unknown, unsupported, unknown CA, and access denied - Classifies errors as "refreshable" (expired, revoked, bad, unknown) vs "non-refreshable" (unsupported, unknown CA, access denied) - Automatically executes refresh command and retries failed HTTP requests and WebSocket connections - Shows user-friendly notifications with appropriate guidance based on error type - Split CertificateError into ServerCertificateError (server cert issues) and ClientCertificateError (client cert issues) - Added execCommand utility for shared command execution with proper logging
EhabY
force-pushed
the
automatic-mtls-refresh
branch
from
0f9c982 to
46800c3
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
coder.tlsCertRefreshCommandsetting to configure a refresh command (e.g.,metatron refresh)Changes
Certificate Error Handling
CertificateErrorintoServerCertificateError(server cert issues) andClientCertificateError(client certissues)
and access denied. Also classify errors as "refreshable" (expired, revoked, bad, unknown) vs "non-refreshable" (unsupported, unknown CA, access denied)
Automatic Refresh & Retry
Code Quality
execCommandutility for shared command execution with proper loggingFixed #714