GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
// AI summary
GoAhead embedded web server builds using OpenSSL with mutual-TLS allow revoked client certificates to pass login because revocation checking was not enabled despite loading a certificate revocation list.
// from the source
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked