docs(tls): document multi-source cipher/SECLEVEL resolution per listener - #598
Conversation
Documents HarperFast/harper#1841 (5.2.0): every configured ciphers source is honored — composed as suites-from-highest-priority-source plus the minimum explicit @SECLEVEL — with CA entries scoped to mTLS-verifying listeners, operationsApi.tls precedence, composition warnings, and the restart-required caveat for post-boot changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-598 This preview will update automatically when you push new commits. |
…A-1 chain wording, Node-path scoping, entry relevance Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-598 This preview will update automatically when you push new commits. |
kriszyp
left a comment
kriszyp
left a comment
There was a problem hiding this comment.
- Documents Harper 5.2's listener-wide Node/OpenSSL cipher and
@SECLEVELresolution. - Explains source relevance and priority, minimum-level composition, and the restart warning for later certificate changes.
- The follow-up commit correctly scopes the behavior away from Bun and tightens the SHA-1 and listener-wide security wording.
- No correctness, clarity, or formatting problems found.
Ethan-Arrowood
left a comment
Ethan-Arrowood
left a comment
There was a problem hiding this comment.
LGTM — I traced every documented rule through the harper#1841 resolver (source priority operationsApi.tls > root tls > cert records, minimum-@SECLEVEL composition, mTLS-only CA participation, the Bun/BoringSSL exception, restart caveat). The worked example composes exactly as documented. Accurate.
sent with Claude Opus 4.8
🧹 Preview CleanupThe preview deployment for this PR has been removed. |
3 participants
Summary
Documents the composed per-listener cipher resolution shipped in HarperFast/harper#1841 (v5.2.0, closes harper#1840):
tls.ciphersfield description updated: the value may live at the top level, ontls[]entries, or on certificate records, and is composed per listener.reference/http/tls.md: source priority (operationsApi.tls> roottls> certificate records), relevance rules (CA entries only for mTLS-verifying listeners;usesmatching incl. legacyhttps/no-usesgenerics), suite-preserving@SECLEVELcomposition with a worked legacy-client-CA example, composition warnings, and the restart-required caveat for post-boot changes.<VersionBadge type="changed" version="v5.2.0" />.Where to look
HIGH:!aNULL+ CADEFAULT@SECLEVEL=0toHIGH:!aNULL@SECLEVEL=0— matches the resolver's unit tests in core.🤖 Generated with Claude Code (Claude Fable 5)