Repair TLS SNI Routing Bugs

The problem

Multi-tenant gateways and proxies often suffer from SNI leakage where wildcard matches cross boundaries or cached TLS contexts bleed between tenants. These routing bugs lead to incorrect certificate selection, broken upstream dispatch, and security vulnerabilities during configuration reloads.

What it does

• Identifies and repairs SNI normalization issues including case sensitivity, trailing dots, and IDNA encoding.
• Enforces exact routing precedence to prevent suffix match hijacking (e.g., evil-example.com matching example.com).
• Fixes race conditions between configuration hot-reloads and in-flight ClientHello handshakes.
• Audits TLS context callbacks to ensure cached state is bound to the correct authority and tenant.
• Generates deterministic local handshake fixtures and loopback tests to verify routing logic without production access.

Frameworks & tools

Works with repository-level configurations for TLS terminators, proxies, and gateways. Uses Read, Edit, and Bash for local environment validation.

Why this beats prompting it yourself

General LLMs often suggest weakening certificate validation or increasing timeouts to "fix" connection errors. This skill enforces a strict ownership contract, ensuring validation occurs before dispatch and that observability remains redacted and protocol-compliant.

Use cases

• Fixing wildcard certificate routing that incorrectly matches multi-label subdomains.
• Preventing tenant context leakage in high-concurrency TLS termination environments.
• Hardening SNI parsers against malformed or ambiguous authority headers.
• Validating that configuration reloads do not interrupt or misroute active TLS handshakes.

Known limitations

Cannot contact production services or read live secrets. It does not modify TLS versions, cipher policies, or global ALPN settings without explicit repository evidence.