MarshallOfSound

#55028: fix: intermittent certificate errors for concurrent requests with setCertificateVerifyProc

Merged
Created: Oct 15, 2026, 4:49:35 PM
Merged: Oct 16, 2026, 2:52:07 AM
8 comments
Target: main

Description of Change

With a setCertificateVerifyProc installed, two requests to the same host issued together on a fresh session could disagree: one went through the proc while the other occasionally completed on Chromium's own verification result, e.g. rejecting with ERR_CERT_AUTHORITY_INVALID even though the proc accepts the certificate. Retrying a moment later always worked.

RemoteCertVerifier only handed a verification to the proc from the upstream verifier's completion callback, and that callback isn't run when the upstream verifier answers synchronously, which the inner CachingCertVerifier does on a cache hit while an earlier verification of the same certificate is still waiting on the proc. This forwards synchronous upstream results to the proc as well.

Added a session spec that opens the second connection from inside the proc for the first one, which hit the window every time before the change.

Checklist

Release Notes

Notes: Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host.

Backports

42-x-y
In-flight
PR Number
#55054
Waiting to be merged
43-x-y
In-flight
PR Number
#55047
Waiting to be merged
44-x-y
In-flight
PR Number
#55046
Waiting to be merged
45-x-y
In-flight
PR Number
#55045
Waiting to be merged

Semver Impact

Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.

Semantic Versioning helps users understand the impact of updates:

  • Major (X.y.z): Breaking changes that may require code modifications
  • Minor (x.Y.z): New features that maintain backward compatibility
  • Patch (x.y.Z): Bug fixes that don't change the API
  • None: Changes that don't affect using facing parts of Electron