view .hgtags @ 28525:dfb21c34e07d

sslutil: allow multiple fingerprints per host

Certificate pinning via [hostfingerprints] is a useful security
feature. Currently, we only support one fingerprint per hostname.
This is simple but it fails in the real world:

* Switching certificates breaks clients until they change the
  pinned certificate fingerprint. This incurs client downtime
  and can require massive amounts of coordination to perform
  certificate changes.
* Some servers operate with multiple certificates on the same
  hostname.

This patch adds support for defining multiple certificate
fingerprints per host. This overcomes the deficiencies listed
above. I anticipate the primary use case of this feature will
be to define both the old and new certificate so a certificate
transition can occur with minimal interruption, so this scenario
has been called out in the help documentation.

d40cc5aacc31ed673d9b5b24f98bee78c283062c 0.4f
1c590d34bf61e2ea12c71738e5a746cd74586157 0.4e
7eca4cfa8aad5fce9a04f7d8acadcd0452e2f34e 0.4d
b4d0c3786ad3e47beacf8412157326a32b6d25a4 0.4c
f40273b0ad7b3a6d3012fd37736d0611f41ecf54 0.5
0a28dfe59f8fab54a5118c5be4f40da34a53cdb7 0.5b
12e0fdbc57a0be78f0e817fd1d170a3615cd35da 0.6
4ccf3de52989b14c3d84e1097f59e39a992e00bd 0.6b
eac9c8efcd9bd8244e72fb6821f769f450457a32 0.6c
979c049974485125e1f9357f6bbe9c1b548a64c3 0.7
3a56574f329a368d645853e0f9e09472aee62349 0.8
6a03cff2b0f5d30281e6addefe96b993582f2eac 0.8.1
35fb62a3a673d5322f6274a44ba6456e5e4b3b37 0.9
2be3001847cb18a23c403439d9e7d0ace30804e9 0.9.1
36a957364b1b89c150f2d0e60a99befe0ee08bd3 0.9.2
27230c29bfec36d5540fbe1c976810aefecfd1d2 0.9.3
fb4b6d5fe100b0886f8bc3d6731ec0e5ed5c4694 0.9.4
23889160905a1b09fffe1c07378e9fc1827606eb 0.9.5
bae2e9c838e90a393bae3973a7850280413e091a 1.0
d5cbbe2c49cee22a9fbeb9ea41daa0ac4e26b846 1.0.1
d2375bbee6d47e62ba8e415c86e83a465dc4dce9 1.0.2
2a67430f92f15ea5159c26b09ec4839a0c549a26 1.1
3773e510d433969e277b1863c317b674cbee2065 1.1.1
11a4eb81fb4f4742451591489e2797dc47903277 1.1.2
11efa41037e280d08cfb07c09ad485df30fb0ea8 1.2
02981000012e3adf40c4849bd7b3d5618f9ce82d 1.2.1
196d40e7c885fa6e95f89134809b3ec7bdbca34b 1.3
3ef6c14a1e8e83a31226f5881b7fe6095bbfa6f6 1.3.1
31ec469f9b556f11819937cf68ee53f2be927ebf 1.4
439d7ea6fe3aa4ab9ec274a68846779153789de9 1.4.1
296a0b14a68621f6990c54fdba0083f6f20935bf 1.4.2
4aa619c4c2c09907034d9824ebb1dd0e878206eb 1.4.3
ff2704a8ded37fbebd8b6eb5ec733731d725da8a 1.5
2b01dab594167bc0dd33331dbaa6dca3dca1b3aa 1.5.1
39f725929f0c48c5fb3b90c071fc3066012456ca 1.5.2
fdcf80f26604f233dc4d8f0a5ef9d7470e317e8a 1.5.3
24fe2629c6fd0c74c90bd066e77387c2b02e8437 1.5.4
f786fc4b8764cd2a5526d259cf2f94d8a66924d9 1.6
bf1774d95bde614af3956d92b20e2a0c68c5fec7 1.6.1
c00f03a4982e467fb6b6bd45908767db6df4771d 1.6.2
ff5cec76b1c5b6be9c3bb923aae8c3c6d079d6b9 1.6.3
93d8bff78c96fe7e33237b257558ee97290048a4 1.6.4
333421b9e0f96c7bc788e5667c146a58a9440a55 1.7
4438875ec01bd0fc32be92b0872eb6daeed4d44f 1.7.1
6aff4f144ad356311318b0011df0bb21f2c97429 1.7.2
e3bf16703e2601de99e563cdb3a5d50b64e6d320 1.7.3
a6c855c32ea081da3c3b8ff628f1847ff271482f 1.7.4
2b2155623ee2559caf288fd333f30475966c4525 1.7.5
2616325766e3504c8ae7c84bd15ee610901fe91d 1.8
aa1f3be38ab127280761889d2dca906ca465b5f4 1.8.1
b032bec2c0a651ca0ddecb65714bfe6770f67d70 1.8.2
3cb1e95676ad089596bd81d0937cad37d6e3b7fb 1.8.3
733af5d9f6b22387913e1d11350fb8cb7c1487dd 1.8.4
de9eb6b1da4fc522b1cab16d86ca166204c24f25 1.9
4a43e23b8c55b4566b8200bf69fe2158485a2634 1.9.1
d629f1e89021103f1753addcef6b310e4435b184 1.9.2
351a9292e430e35766c552066ed3e87c557b803b 1.9.3
384082750f2c51dc917d85a7145748330fa6ef4d 2.0-rc
41453d55b481ddfcc1dacb445179649e24ca861d 2.0
195dbd1cef0c2f9f8bcf4ea303238105f716bda3 2.0.1
6344043924497cd06d781d9014c66802285072e4 2.0.2
db33555eafeaf9df1e18950e29439eaa706d399b 2.1-rc
2aa5b51f310fb3befd26bed99c02267f5c12c734 2.1
53e2cd303ecf8ca7c7eeebd785c34e5ed6b0f4a4 2.1.1
b9bd95e61b49c221c4cca24e6da7c946fc02f992 2.1.2
d9e2f09d5488c395ae9ddbb320ceacd24757e055 2.2-rc
00182b3d087909e3c3ae44761efecdde8f319ef3 2.2
5983de86462c5a9f42a3ad0f5e90ce5b1d221d25 2.2.1
85a358df5bbbe404ca25730c9c459b34263441dc 2.2.2
b013baa3898e117959984fc64c29d8c784d2f28b 2.2.3
a06e2681dd1786e2354d84a5fa9c1c88dd4fa3e0 2.3-rc
7f5094bb3f423fc799e471aac2aee81a7ce57a0b 2.3
072209ae4ddb654eb2d5fd35bff358c738414432 2.3.1
b3f0f9a39c4e1d0250048cd803ab03542d6f140a 2.3.2
d118a4f4fd16d9b558ec3f3e87bfee772861d2b7 2.4-rc
195ad823b5d58c68903a6153a25e3fb4ed25239d 2.4
0c10cf8191469e7c3c8844922e17e71a176cb7cb 2.4.1
a4765077b65e6ae29ba42bab7834717b5072d5ba 2.4.2
f5fbe15ca7449f2c9a3cf817c86d0ae68b307214 2.5-rc
a6088c05e43a8aee0472ca3a4f6f8d7dd914ebbf 2.5
7511d4df752e61fe7ae4f3682e0a0008573b0402 2.5.1
5b7175377babacce80a6c1e12366d8032a6d4340 2.5.2
50c922c1b5145dab8baefefb0437d363b6a6c21c 2.5.3
8a7bd2dccd44ed571afe7424cd7f95594f27c092 2.5.4
292cd385856d98bacb2c3086f8897bc660c2beea 2.6-rc
23f785b38af38d2fca6b8f3db56b8007a84cd73a 2.6
ddc7a6be20212d18f3e27d9d7e6f079a66d96f21 2.6.1
cceaf7af4c9e9e6fa2dbfdcfe9856c5da69c4ffd 2.6.2
009794acc6e37a650f0fae37872e733382ac1c0c 2.6.3
f0d7721d7322dcfb5af33599c2543f27335334bb 2.7-rc
f37b5a17e6a0ee17afde2cdde5393dd74715fb58 2.7
335a558f81dc73afeab4d7be63617392b130117f 2.7.1
e7fa36d2ad3a7944a52dca126458d6f482db3524 2.7.2
1596f2d8f2421314b1ddead8f7d0c91009358994 2.8-rc
d825e4025e39d1c39db943cdc89818abd0a87c27 2.8
209e04a06467e2969c0cc6501335be0406d46ef0 2.8.1
ca387377df7a3a67dbb90b6336b781cdadc3ef41 2.8.2
8862469e16f9236208581b20de5f96bd13cc039d 2.9-rc
3cec5134e9c4bceab6a00c60f52a4f80677a78f2 2.9
b96cb15ec9e04d8ac5ee08b34fcbbe4200588965 2.9.1
3f83fc5cfe715d292069ee8417c83804f6c6c1e4 2.9.2
564f55b251224f16508dd1311452db7780dafe2b 3.0-rc
2195ac506c6ababe86985b932f4948837c0891b5 3.0
269c80ee5b3cb3684fa8edc61501b3506d02eb10 3.0.1
2d8cd3d0e83c7336c0cb45a9f88638363f993848 3.0.2
6c36dc6cd61a0e1b563f1d51e55bdf4dacf12162 3.1-rc
3178e49892020336491cdc6945885c4de26ffa8b 3.1
5dc91146f35369949ea56b40172308158b59063a 3.1.1
f768c888aaa68d12dd7f509dcc7f01c9584357d0 3.1.2
7f8d16af8cae246fa5a48e723d48d58b015aed94 3.2-rc
ced632394371a36953ce4d394f86278ae51a2aae 3.2
643c58303fb0ec020907af28b9e486be299ba043 3.2.1
902554884335e5ca3661d63be9978eb4aec3f68a 3.2.2
6dad422ecc5adb63d9fa649eeb8e05a5f9bc4900 3.2.3
1265a3a71d75396f5d4cf6935ae7d9ba5407a547 3.2.4
db8e3f7948b1fdeb9ad12d448fc3525759908b9f 3.3-rc
fbdd5195528fae4f41feebc1838215c110b25d6a 3.3
5b4ed033390bf6e2879c8f5c28c84e1ee3b87231 3.3.1
07a92bbd02e5e3a625e0820389b47786b02b2cea 3.3.2
2e2e9a0750f91a6fe0ad88e4de34f8efefdcab08 3.3.3
e89f909edffad558b56f4affa8239e4832f88de0 3.4-rc
8cc6036bca532e06681c5a8fa37efaa812de67b5 3.4
ed18f4acf435a2824c6f49fba40f42b9df5da7ad 3.4.1
540cd0ddac49c1125b2e013aa2ff18ecbd4dd954 3.4.2
96a38d44ba093bd1d1ecfd34119e94056030278b 3.5-rc
21aa1c313b05b1a85f8ffa1120d51579ddf6bf24 3.5
1a45e49a6bed023deb229102a8903234d18054d3 3.5.1
9a466b9f9792e3ad7ae3fc6c43c3ff2e136b718d 3.5.2
b66e3ca0b90c3095ea28dfd39aa24247bebf5c20 3.6-rc
47dd34f2e7272be9e3b2a5a83cd0d20be44293f4 3.6
1aa5083cbebbe7575c88f3402ab377539b484897 3.6.1
2d437a0f3355834a9485bbbeb30a52a052c98f19 3.6.2
ea389970c08449440587712117f178d33bab3f1e 3.6.3
158bdc8965720ca4061f8f8d806563cfc7cdb62e 3.7-rc
2408645de650d8a29a6ce9e7dce601d8dd0d1474 3.7
b698abf971e7377d9b7ec7fc8c52df45255b0329 3.7.1
d493d64757eb45ada99fcb3693e479a51b7782da 3.7.2