Re: Breakage in ktls-utils with nfs keyring?

Cc'ing the ktls-utils development list.

On Thu, Apr 30, 2026, at 9:32 AM, Sagi Grimberg wrote:
> Hey Chuck,
>
> Upstream ktls-utils fails passing client certificate and private key 
> using the .nfs keyring.
> Bisecting leads commit facd084e43fc ("tlshd: Client-side dual 
> certificate support").
>
> I manually apply this (probably wrong) change and keyring works:
> --
> diff --git a/src/tlshd/client.c b/src/tlshd/client.c
> index 2664ffb..a946797 100644
> --- a/src/tlshd/client.c
> +++ b/src/tlshd/client.c
> @@ -327,7 +327,7 @@ tlshd_x509_retrieve_key_cb(gnutls_session_t session,
>          } else {
>                  tlshd_log_debug("%s: Selecting x509.certificate from 
> conf file", __func__);
>                  *pcert_length = tlshd_certs_len;
> -               *pcert = tlshd_certs + tlshd_pq_certs_len;
> +               *pcert = tlshd_certs;
>                  *privkey = tlshd_privkey;
>          }
>          return 0;
> --
>
> But, I have a feeling its not the correct change...


Scott, can you triage this?


-- 
Chuck Lever