caddytls: Return errors instead of nil in client auth provisioning (#7464)

Two error returns in ClientAuthentication.provision() were returning nil instead of the actual error, silently swallowing failures when converting PEM files to DER and when provisioning the CA pool. This could cause mTLS client authentication to silently fall back to the system trust store, accepting any client certificate signed by a public CA instead of restricting to the configured trust anchors.

moscowchill committed Feb 12, 2026 at 23:42 UTC d42d39b4bc237c628f9a95363b28044cb7a7fe72

1 file changed +2 -2

modules/caddytls/connpolicy.go

+2 -2

@@ -784,7 +784,7 @@ func (clientauth *ClientAuthentication) provision(ctx caddy.Context) error {

784 for _, fpath := range clientauth.TrustedCACertPEMFiles {

785 ders, err := convertPEMFilesToDER(fpath)

786 if err != nil {

787 - return nil

787 + return err

788 }

789 clientauth.TrustedCACerts = append(clientauth.TrustedCACerts, ders...)

790 }

@@ -797,7 +797,7 @@ func (clientauth *ClientAuthentication) provision(ctx caddy.Context) error {

797 }

798 err := caPool.Provision(ctx)

799 if err != nil {

800 - return nil

800 + return err

801 }

802 clientauth.ca = caPool

803 }