ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
When a Ballerina Swan Lake http:Client call fails TLS validation, the secureSocket record offers two levers: a cert field for custom trust (a PKCS12 truststore or PEM file) and a verifyHostName boolean that switches name checking off. Certificate validation is enabled by default, and the documented escape hatch for a name-mismatch failure is setting verifyHo
When upgrading a self‑hosted Appwrite deployment from version 1.3.x to 1.4.x, administrators need to know whether the platform still accepts TLS certificates that rely only on a Common Name (CN) match when no Subject Alternative Name (SAN) is present. The 1.4.0 release notes indicate that strict hostname verification was introduced and that the fallback to C
OpenSSL 1.1.0 introduced the X509_VERIFY_PARAM_set1_host and SSL_set1_host APIs to implement RFC 2818 hostname verification. Unlike previous versions where some tools performed implicit checks, this verification is not enabled by default in the library; applications must explicitly set the target host name to activate the check. This change affects how the s
Goal Determine whether Elasticsearch performs a reverse DNS lookup on the remote IP address when verification_mode is set to certificate and how the JVM's networkaddress.cache.ttl influences the hostname used in the TLS handshake when the underlying DNS record uses round-robin load balancing. Constraints and uncertainty In versions prior to 8.12, Elasticsear
Couchbase SDKs use couchbases:// for encrypted connections and validate the server certificate chain and hostname during the TLS handshake. The uncertainty is which hostname the SDK compares against the certificate's Subject Alternative Names (SAN) when the address used for bootstrap differs from the addresses the cluster advertises later. Several conditions
Context Kafka clients using the default ssl.endpoint.identification.algorithm=HTTPS verify the broker certificate hostname against the DNS name used at connection establishment. The verification occurs once during the initial handshake and is not repeated for the lifetime of that connection. Problem In environments with DNS-based failover or rolling broker u
When configuring a DBeaver connection to use SSL with a self‑signed or private‑CA certificate, the user can enable the “Trust server certificate” option or import the certificate into the connection‑specific truststore. The intended goal is to allow the connection to succeed despite the certificate not being present in the Java default truststore. However, i
Symptom A Boost.Asio SSL client configured with ssl::verify_peer successfully validates a server certificate chain — trust anchor, expiration, and signature — yet connects to a host whose certificate contains a different Subject Alternative Name or Common Name than the target hostname. No verification failure occurs unless the application installs a custom c
ballerina
openssl
elasticsearch
couchbase
apachekafka
dbeaver