From ff5ec74fc2518f20e704f9490790df5cfc3f9403 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Wed, 17 Jun 2026 10:59:42 -0400 Subject: [PATCH] tls: keep maximum_version at MAXIMUM_SUPPORTED (was wrong workaround) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverted the TLS 1.2 max default I added while chasing what turned out to be a make_post_sell bug, not an OTP bug. The actual root cause of the production smoke-test failure was that mps_wallet_dist_health hardcoded the REG_SEND target as 'Elixir.Wallet.Service' but portal registers the relay as 'Elixir.Wallet.Bridge' — REG_SEND to an unregistered name silently drops at the dist driver, presenting as the 'peer closed after 0/4 bytes' symptom that I misdiagnosed as a TLS problem. Fix landed in make_post_sell 1.2.1. erldistpy's defaults should stay where Python ssl wants them; callers who want a specific version can still pin via kwargs. --- erldistpy/tls.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/erldistpy/tls.py b/erldistpy/tls.py index 36e7569..52f9596 100644 --- a/erldistpy/tls.py +++ b/erldistpy/tls.py @@ -36,6 +36,7 @@ def make_dist_tls_context( ca: str, check_hostname: bool = False, minimum_version: ssl.TLSVersion = ssl.TLSVersion.TLSv1_2, + maximum_version: ssl.TLSVersion = ssl.TLSVersion.MAXIMUM_SUPPORTED, ) -> ssl.SSLContext: """Build an SSLContext for a TLS-dist client. @@ -43,11 +44,16 @@ def make_dist_tls_context( and requires one). ``check_hostname=False`` because dist nodes are identified by their cookie + cert chain, not by SNI hostname; flip on if your CA pins per-node CNs. + + ``maximum_version`` defaults to the highest version Python's ssl + supports (TLS 1.3 in practice). Pin to TLS 1.2 explicitly only if + you hit interop issues against an older Erlang peer. """ ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) ctx.check_hostname = check_hostname ctx.verify_mode = ssl.CERT_REQUIRED ctx.minimum_version = minimum_version + ctx.maximum_version = maximum_version ctx.load_cert_chain(certfile=cert, keyfile=key) ctx.load_verify_locations(cafile=ca) return ctx