What would you like to be added:
verify_peer_certificate should record an advertised-certificate mismatch rather than return a failing outcome, and the docs should be made consistent about it.
Why is this needed:
The documented contract is inconsistent. auth.md describes Mutual-mode verification as checking "the live leaf certificate against spec.trust.canonicalFingerprints" and says publicCertPem "does not indicate the remote site is authenticated or authorized for routing". operations.md documents the advertised check and its demotion, and crds.md tabulates the same. This proposes adopting the auth.md reading and correcting the other two.
The advertised copy has no trust consumer. Roots come from spec.tls.caSecretRef, client identity from siteSecretRef, and pins from spec.trust; none reads status, and the rendered Praxis config carries mount paths rather than certificate bytes. So the check gates nothing, and its only effect is to move the site out of Active and therefore out of routing eligibility.
Two things suggest that response is disproportionate. The documented remedy is "wait for certificate gossip to converge", which is not a condition that should remove a site from routing. And the check is skipped entirely when the field is absent, so it only affects peers that do advertise.
Keeping the detection looks worthwhile. Acting on it is probably the part worth removing.
What would you like to be added:
verify_peer_certificateshould record an advertised-certificate mismatch rather than return a failing outcome, and the docs should be made consistent about it.Why is this needed:
The documented contract is inconsistent.
auth.mddescribes Mutual-mode verification as checking "the live leaf certificate againstspec.trust.canonicalFingerprints" and sayspublicCertPem"does not indicate the remote site is authenticated or authorized for routing".operations.mddocuments the advertised check and its demotion, andcrds.mdtabulates the same. This proposes adopting theauth.mdreading and correcting the other two.The advertised copy has no trust consumer. Roots come from
spec.tls.caSecretRef, client identity fromsiteSecretRef, and pins fromspec.trust; none reads status, and the rendered Praxis config carries mount paths rather than certificate bytes. So the check gates nothing, and its only effect is to move the site out ofActiveand therefore out of routing eligibility.Two things suggest that response is disproportionate. The documented remedy is "wait for certificate gossip to converge", which is not a condition that should remove a site from routing. And the check is skipped entirely when the field is absent, so it only affects peers that do advertise.
Keeping the detection looks worthwhile. Acting on it is probably the part worth removing.