Repository navigation
security: mTLS client certificates are not enforced in Linux release binaries #1551
Description
Summary
The prebuilt Linux binaries published in the ttyd releases are built with Mbed TLS, and mTLS client certificate enforcement does not appear to work correctly with those binaries.
When ttyd is started with --ssl-ca, the server asks the client to provide a certificate, but if the client does not provide one, the connection is still allowed to continue. This makes mTLS effectively bypassable for users relying on the official Linux release binaries.
Impact
Users may expect --ssl-ca to require a valid client certificate before allowing access to ttyd. With the affected Linux release binaries, clients without a certificate can still connect, so deployments relying on mTLS for access control may be exposed.
Affected builds
The latest release, 1.7.7, publishes Linux binaries such as:
ttyd.x86_64ttyd.aarch64ttyd.armttyd.armhf- other Linux cross-build artifacts
At the 1.7.7 tag, scripts/cross-build.sh builds libwebsockets with Mbed TLS:
MBEDTLS_VERSION=2.28.5-DLWS_WITH_MBEDTLS=ON
The current main branch appears to have switched the cross-build script to OpenSSL, but the published Linux release binaries are still Mbed TLS based.
Expected behavior
When ttyd is started with SSL and --ssl-ca, a client that does not provide a valid client certificate should be rejected during TLS negotiation and should not be able to access HTTP or WebSocket endpoints.
Actual behavior
The server requests a client certificate, but clients that do not provide one are still allowed to continue the connection.
Suggested fix
Please ensure release binaries enforce client certificate verification correctly when --ssl-ca is configured. If this is caused by the Mbed TLS backend or libwebsockets integration, consider rebuilding Linux release binaries with OpenSSL or otherwise disabling affected Mbed TLS release builds until mTLS enforcement is verified.
Activity