Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

doc: add a disclamer for the TLS handshake timeouts TL;DR bug in godebug.md #311

Closed
wants to merge 2 commits into from
Closed

doc: add a disclamer for the TLS handshake timeouts TL;DR bug in godebug.md #311

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7f2a9ac
doc: TLS TL;DR bug discalmer
thomvaill Feb 20, 2025
a709e6f
fix typo and rephrase
thomvaill Feb 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions _content/doc/go1.23.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,6 +293,8 @@ the GODEBUG environment variable.
The experimental post-quantum key exchange mechanism X25519Kyber768Draft00
is now enabled by default when [`Config.CurvePreferences`](/pkg/crypto/tls#Config.CurvePreferences) is nil.
The default can be reverted by adding `tlskyber=0` to the GODEBUG environment variable.
This can be useful when dealing with buggy TLS servers that do not handle large records correctly,
causing a timeout during the handshake (see [TLS post-quantum TL;DR fail](https://tldr.fail/)).

Go 1.23 changed the behavior of [`X509KeyPair`](/pkg/crypto/tls#X509KeyPair) and [`LoadX509KeyPair`](/pkg/crypto/tls#LoadX509KeyPair)
to populate the [`Certificate.Leaf`](/pkg/crypto/tls#Certificate.Leaf) field of the returned [`Certificate`](/pkg/crypto/tls#Certificate).
Expand Down
2 changes: 2 additions & 0 deletions _content/doc/go1.24.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -480,6 +480,8 @@ The new post-quantum [`X25519MLKEM768`](/pkg/crypto/tls#X25519MLKEM768) key
exchange mechanism is now supported and is enabled by default when
[`Config.CurvePreferences`](/pkg/crypto/tls#Config.CurvePreferences) is nil.
[GODEBUG setting](/doc/godebug) `tlsmlkem=0` reverts the default.
This can be useful when dealing with buggy TLS servers that do not handle large records correctly,
causing a timeout during the handshake (see [TLS post-quantum TL;DR fail](https://tldr.fail/)).

Support for the experimental `X25519Kyber768Draft00` key exchange has been removed.

Expand Down