issuer.Cache: the certificate cache behind the Issuer seam #46

Merged

mikluko merged 1 commit from refactor/issuer-cache into main

2026-10-26 22:14:31 +00:00

mikluko commented

2026-10-26 22:12:40 +00:00

Owner

Candidate 4 of the architecture review.

Caching, per-name locking and expiry lived in the MITM handler, tested only through a full CONNECT session. issuer.Cache is now a second adapter at the Issuer seam: it keeps the certificates another Issuer issues, per common name, and issues again past NotAfter. Concurrent requests for one name wait for a single issue, and errors are not kept. TestCache covers each point without TLS or a proxy.

MITMHandler keeps only the mapping from host to certificate names. Its default Issuer and the command's both wrap SelfSignedCA in the cache.

Breaking for library users: MITMHandler.CertCacheSize is removed. An Issuer you set yourself is called on every CONNECT unless you wrap it in issuer.Cache.

The suite passes three times in a row under -race.

Candidate 4 of the architecture review. Caching, per-name locking and expiry lived in the MITM handler, tested only through a full `CONNECT` session. `issuer.Cache` is now a second adapter at the Issuer seam: it keeps the certificates another Issuer issues, per common name, and issues again past `NotAfter`. Concurrent requests for one name wait for a single issue, and errors are not kept. `TestCache` covers each point without TLS or a proxy. `MITMHandler` keeps only the mapping from host to certificate names. Its default Issuer and the command's both wrap `SelfSignedCA` in the cache. Breaking for library users: `MITMHandler.CertCacheSize` is removed. An Issuer you set yourself is called on every `CONNECT` unless you wrap it in `issuer.Cache`. The suite passes three times in a row under `-race`.

mikluko added 1 commit

2026-10-26 22:12:40 +00:00

issuer.Cache: the certificate cache behind the Issuer seam

CI / changelog (pull_request) Successful in 6s

Details

CI / test (pull_request) Successful in 1m27s

Details

ec22921b68

Caching, per-name locking and expiry lived in the MITM handler, tested only
through a CONNECT session. issuer.Cache is now a second adapter at the Issuer
seam, tested directly, including that concurrent requests for one name issue
once and that errors are not kept. MITMHandler keeps the host-to-name mapping
and loses CertCacheSize.

mikluko merged commit 0df359d472 into main

2026-10-26 22:14:31 +00:00

mikluko deleted branch refactor/issuer-cache

2026-10-26 22:14:32 +00:00

mikluko referenced this pull request from a commit

2026-10-26 22:14:32 +00:00

Merge pull request 'issuer.Cache: the certificate cache behind the Issuer seam' (#46) from refactor/issuer-cache into main