mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-28 13:31:12 +00:00
33b50089cd
Publicly-CA-valid gateway hosts (e.g. Tailscale Funnel with Let's Encrypt) no longer force fingerprint pinning: a real platform-trust handshake with HTTPS hostname verification and SNI connects without prompting, ending the changed-pin re-prompt on every cert renewal. Candidate gating excludes .local, IP literals, and single-label hosts so LAN endpoints keep pinning. Existing pins stay authoritative: a valid public chain never silently clears a stored pin - the changed-pin prompt gains an explicit one-time 'Use system trust' switch instead. Discovered endpoints still require a stored pin for reconnect eligibility (discovery data is attacker-controllable). When the TLS probe cannot capture a certificate, the trust dialog now accepts an out-of-band SHA-256 fingerprint paste (sha256:/colon tolerant, 64-hex validated) which is then enforced on connect. Malformed stored pins now fail closed instead of silently degrading. Both probe attempts share one connect+handshake budget so stalled hosts cannot double the probe latency.