TLS hardening: verify-peer by default
Earlier this year we shipped verified TLS/HTTPS support in CMSDK, with a network_https test performing a real handshake and encrypted round-trips over loopback using a runtime-generated certificate. That proved the transport worked. It did not, on its own, make it safe by default — and we said at the time that certificate-verification hardening was on the roadmap.
That work is now done. The CMSDK SSL layer has been tightened where it actually counts:
- Client-side hostname verification — a valid certificate for the wrong host is no longer accepted
- Custom CA locations — point at your own trust store, which matters for internal PKI and air-gapped deployments
- Verify-peer is now the default, with self-signed certificates an explicit
allowselfsignedopt-in rather than a silent fallback
That last point is the one we care most about. The failure mode of a permissive TLS stack is not a crash — it is a connection that looks encrypted, reports success, and quietly accepts anyone. Defaulting to verification means the insecure path now requires you to ask for it by name, in a config you can grep for at review time.
Errors you can actually see
Silent security failures are the expensive kind. OpenSSL handshake and certificate errors are now routed through the log system instead of being swallowed at the call site, so a rejected certificate or a failed handshake shows up in your logs with a reason attached rather than presenting as a generic connection problem.
Why this matters for real-time systems
Psyclone is natively multi-node: modules run across machines over TCP and UDP by design. The moment a real-time fabric crosses a network boundary — between racks, sites, or into a cloud region — transport security stops being optional. Getting verified TLS into the same stack that delivers sub-100µs local messaging means you do not have to choose between speed inside the node and safety between nodes.
Secure defaults, with the escape hatch clearly labelled. Build with make ssl and the network_https test exercises the whole path.
Full detail is in the CMSDK reference and the 2.1.1 release announcement.
