deb

libnetplus (20260711+25) unstable; urgency=high

  * tls::CertificateBundle::loadFromFile(): detect PEM vs DER by content

    (sniff for "-----BEGIN ") instead of by file extension. The non-

    ".pem" branch called x509cert::loadFromFile(), which parses only the

    first certificate block and never touches `chain` — so a multi-cert

    PEM bundle (leaf + intermediate CA) shipped under any other

    extension (fullchain.crt, server.cer, ...) had its intermediate

    silently dropped. The server then handshook with a leaf-only chain:

    clients that don't chase the missing intermediate via AIA reject it

    with a fatal certificate_unknown (tls13 alert desc=46) — reproduced

    on two separate mediadb nodes.

 -- Jan Koester <jan.koester@tuxist.de>  Sat, 11 Jul 2026 19:00:00 +0200

libnetplus (20260629+24) unstable; urgency=medium

  * tls: extend TLS 1.2 ECDHE support with ECDHE_RSA suites