Add automatic TLS client certificate refresh support #732
+1,035
−259
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
EhabY
force-pushed
the
automatic-mtls-refresh
branch
3 times, most recently
from
e6ef17f to
871a6e4
Compare
EhabY
changed the title
EhabY
force-pushed
the
automatic-mtls-refresh
branch
from
871a6e4 to
bc732ea
Compare
johnstcn
reviewed
Jan 20, 2026
EhabY
force-pushed
the
automatic-mtls-refresh
branch
from
0f9c982 to
46800c3
Compare
johnstcn
reviewed
Jan 21, 2026
johnstcn
approved these changes
Jan 21, 2026
jakehwll
reviewed
Jan 21, 2026
jakehwll
reviewed
Jan 21, 2026
jakehwll
approved these changes
Jan 21, 2026
…en they fail - New coder.tlsCertRefreshCommand setting to configure a refresh command (e.g., metatron refresh) - Detects 7 SSL/TLS client certificate alert codes: expired, revoked, bad certificate, unknown, unsupported, unknown CA, and access denied - Classifies errors as "refreshable" (expired, revoked, bad, unknown) vs "non-refreshable" (unsupported, unknown CA, access denied) - Automatically executes refresh command and retries failed HTTP requests and WebSocket connections - Shows user-friendly notifications with appropriate guidance based on error type - Split CertificateError into ServerCertificateError (server cert issues) and ClientCertificateError (client cert issues) - Added execCommand utility for shared command execution with proper logging
EhabY
force-pushed
the
automatic-mtls-refresh
branch
from
46800c3 to
6b5c704
Compare
EhabY
force-pushed
the
automatic-mtls-refresh
branch
from
6b5c704 to
92ab411
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
coder.tlsCertRefreshCommandsetting to configure a refresh command (e.g.,metatron refresh)Changes
Certificate Error Handling
CertificateErrorintoServerCertificateError(server cert issues) andClientCertificateError(client certissues)
and access denied. Also classify errors as "refreshable" (expired, revoked, bad, unknown) vs "non-refreshable" (unsupported, unknown CA, access denied)
Automatic Refresh & Retry
Code Quality
execCommandutility for shared command execution with proper loggingFixed #714