Did this board recently switch to dezhemini?
It did not, it's still using my haskell-gemini libraries. I did add client cert support though :)
Hmm. It started refusing my attempts to resume TLS sessions. Have to do a full handshake each time now.
So maybe this is related to the limitation of the haskell tls library that it doesn't let you get the client certificate for a resumed session? Are you just disallowing resumed sessions to get around this? If so, maybe you can do it more nicely so it doesn't just give an error in the client.
Maybe? I mostly used default options, so it could also be that I just have to explicitly enable resumption. Let me check...
Ah right, I forgot to mention that while now I'm using HsOpenSSL to handle TLS, before then the haskell server did not handle encrypted connections at all, it was just behind stunnel (which apparently does support resumption)
Hmm, this is really weird. I don't set any initialization option that could affect resumption and I also set SSL_VERIFY_CLIENT_ONCE... could it be because I'm doing an unidirectional shutdown?
I don't know... let's discuss this by email? mbays@sdf.org
Aaaand... fixed! It was the missing session id context