GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.

In FoxIO's test against GoAhead 6.1.0 with OpenSSL 3.6.2, a revoked certificate was accepted with issuer checking switched on.

The OpenSSL advisory describes revoked client certificates as silently accepted.

Builds that use the Mbed TLS backend are unaffected; that backend checks revocation via a separate code path.

TLS build What goes wrong Affected versions Fix or interim option OpenSSL (default) Revocation list loaded but never enforced; revoked client certificates accepted.