addon/verifypeer/crl.go-114-114 (1)

114-114: Typo in error message: "lhe" should be "the".

📝 Suggested fix

-				return errors.New("tls: lhe certificate was revoked")
+				return errors.New("tls: the certificate was revoked")

addon/verifypeer/crl.go-52-52 (1)

52-52: Fix doc comment: incorrect interface name.

📝 Suggested fix

-// CustomizeServerTLS implements [fiber.ServerCertificateCustomizer]
+// CustomizeServerTLS implements [fiber.ServerTLSCustomizer]

addon/verifypeer/cert.go-27-28 (1)

27-28: Typo in doc comment.

"certiticate" should be "certificate".

📝 Suggested fix

-// It will add the certiticate to config.ClientCAs and set config.ClientAuth to tls.RequireAndVerifyClientCert
+// It will add the certificate to config.ClientCAs and set config.ClientAuth to tls.RequireAndVerifyClientCert

addon/verifypeer/crl.go-19-19 (1)

19-19: Fix doc comment: incorrect interface name.

Same as in cert.go, the comment references [fiber.ServerCertificateCustomizer] but should be fiber.ServerTLSCustomizer.

📝 Suggested fix

-// MutualTLSWithCRLCustomizer is a struct implementing [fiber.ServerCertificateCustomizer].
+// MutualTLSWithCRLCustomizer is a struct implementing [fiber.ServerTLSCustomizer].

addon/verifypeer/cert.go-14-14 (1)

14-14: Fix doc comment: incorrect interface name.

The comment references [fiber.ServerCertificateCustomizer] but the actual interface is fiber.ServerTLSCustomizer.

📝 Suggested fix

-// MutualTLSCustomizer is a struct implementing [fiber.ServerCertificateCustomizer].
+// MutualTLSCustomizer is a struct implementing [fiber.ServerTLSCustomizer].

docs/addon/verifypeer.md-7-12 (1)

7-12: Fix typos and interface naming in VerifyPeer docs.

There are several spelling issues and outdated interface names (“ServerCertificateCustomizer”, “OCSP Stapler”).

📝 Suggested doc edits

-The VerifyPeer addon package aim is to provides aadditional `fiber.ServerTLSCustomizer` interface implementationsto add means
-to configure a `*tls.Config` 's `VerifyPeerCertificate` field with additional validation for client mTLS connection.
+The VerifyPeer addon package aims to provide additional `fiber.ServerTLSCustomizer` implementations to configure a
+`*tls.Config`'s `VerifyPeerCertificate` field with extra validation for client mTLS connections.
@@
-`MutualTLSCustomizer` is a struct implementing `fiber.ServerCertificateCustomizer`, providing MutualTLS configuration to a `tls.Config` object.
+`MutualTLSCustomizer` is a struct implementing `fiber.ServerTLSCustomizer`, providing MutualTLS configuration to a `tls.Config` object.
@@
-See [OpenSSL documenation](https://docs.openssl.org/3.5/man1/openssl-ca/#crl-options) for more information.
+See [OpenSSL documentation](https://docs.openssl.org/3.5/man1/openssl-ca/#crl-options) for more information.
@@
-## MutualTLS with OCSP Stapler
+## MutualTLS with OCSP Stapling

Also applies to: 47-49, 75-79

addon/verifypeer/listen_test.go-86-92 (1)

86-92: Fix typo in testdata path.

testdate looks like a typo; it likely should be testdata.

✅ Suggested fix

-			Certificate: "../../.github/testdate/template.html",
+			Certificate: "../../.github/testdata/template.html",

client/tls_provider_test.go-50-52 (1)

50-52: Avoid deferring Close before ensuring os.Open succeeded.

If os.Open fails, file is nil and the deferred Close will panic.

✅ Suggested fix

 	file, err := os.Open("../.github/testdata/pki/cacert.pem")
-	defer func() { require.NoError(t, file.Close()) }()
 	require.NoError(t, err)
+	defer func() { require.NoError(t, file.Close()) }()

addon/verifypeer/ocsp.go-19-40 (1)

19-40: Align OCSP customizer docs with actual behavior.

The comments reference ServerCertificateCustomizer and a 1-second default, but the code implements ServerTLSCustomizer and sets 10 seconds.

📝 Suggested doc fix

-// MutualTLSWithOCSPCustomizer is a struct implementing [fiber.ServerCertificateCustomizer].
+// MutualTLSWithOCSPCustomizer is a struct implementing [fiber.ServerTLSCustomizer].
@@
-	// Default: 1 * time.Seconds
+	// Default: 10 * time.Second
 	Timeout time.Duration `json:"timeout"`

docs/client/rest.md-376-383 (1)

376-383: Fix typo and hard tabs in the SetTLSProvider section.

There’s a typo (“ths”) and markdownlint flags hard tabs in the interface snippet.

📝 Suggested fix

- Sets ths TLS configuration for the client, using the `ClientTLSProvider` interface.
+ Sets the TLS configuration for the client, using the `ClientTLSProvider` interface.
@@
 type ClientTLSProvider interface {
-	ProvideClientTLS() (*tls.Config, error)
+    ProvideClientTLS() (*tls.Config, error)
 }

As per coding guidelines, run make markdown after updating this file.

docs/whats_new.md-190-213 (1)

190-213: Tidy grammar and remove hard tabs in the TLS provider section.

The section has a grammar slip and markdownlint reports hard tabs in the code blocks.

📝 Suggested fix

-We provider now two interfaces and implementations to let you configure TLS in `ListenConfig`:
+We provide two interfaces and implementations to let you configure TLS in `ListenConfig`:
@@
 type ServerTLSProvider interface {
-	    ProvideServerTLS() (*tls.Config, error)
+    ProvideServerTLS() (*tls.Config, error)
 }
@@
 type ServerTLSCustomizer interface {
-	    CustomizeServerTLS(config *tls.Config) error
+    CustomizeServerTLS(config *tls.Config) error
 }
@@
-It can be a string to file or its content directly :
+It can be a file path or its content directly:

As per coding guidelines, run make markdown after updating this file.

tls_provider_test.go-13-17 (1)

13-17: Add t.Parallel() at the start of each test function.

These tests lack the required parallel execution directive. According to the repository's coding guidelines, all test functions should call t.Parallel() at the beginning to maximize concurrency.

Suggested change (apply to each test)

func Test_ServerTLSProvider_Version(t *testing.T) {
+	t.Parallel()
	testPreforkMaster = true

Applies to: Test_ServerTLSProvider_Version (line 13), Test_ServerTLSProvider (line 57), Test_ServerTLSProvider_Deprecated (line 80), Test_ServerTLSProvider_Prefork (line 105), Test_ServerTLSProvider_Prefork_Deprecated (line 134).

addon/verifypeer/ocsp_responder_test.go-137-138 (1)

137-138: Incorrect format specifier usage in logging calls.

The log.Errorf and log.Info calls use incorrect format specifiers:

1. %w is for fmt.Errorf error wrapping, not for logging—use %v instead
2. log.Info and log.Warn don't use printf-style formatting; use log.Infof/log.Warnf for formatted output

-	log.Errorf("%w", err)
+	log.Errorf("issuer verification failed: %v", err)
 	return nil, err
 }
 
 // get the index entry, if it exists
 ent, err := o.getIndexEntry(req.SerialNumber)
 if err != nil {
-	log.Errorf("%w", err)
+	log.Errorf("index entry lookup failed: %v", err)
 	status = ocsp.Unknown
 } else {
-	log.Info("Found entry %+v", ent)
+	log.Infof("Found entry %+v", ent)

Similar fixes needed for log.Warn on line 150 and log.Info on lines 154, 270.

Also applies to: 144-147

docs/api/fiber.md-120-120 (1)

120-120: Fix typo: "rewiewing" → "reviewing"

-| <Reference id="tlsconfigfunc">TLSConfigFunc</Reference>                 | `func(tlsConfig *tls.Config)` | Allows rewiewing and customizing `tls.Config` returned from `TLSProvider` as you want. `tlsConfig` may be `nil` if none is returned from `TLSProvider`                                                                                                                       | `nil`              |
+| <Reference id="tlsconfigfunc">TLSConfigFunc</Reference>                 | `func(tlsConfig *tls.Config)` | Allows reviewing and customizing `tls.Config` returned from `TLSProvider` as you want. `tlsConfig` may be `nil` if none is returned from `TLSProvider`                                                                                                                       | `nil`              |

tls_provider.go-12-21 (1)

12-21: Fix typo in interface documentation: "Implentations" → "Implementations"

-	// NOTE: Implentations may return (nil, nil) if no tls.Config can be provided and no error occurred.
+	// NOTE: Implementations may return (nil, nil) if no tls.Config can be provided and no error occurred.

docs/api/fiber.md-173-173 (1)

173-173: Fix duplicate word: "also be also" → "also be"

-`Certificate` can also be also a string containing what that file should contain.
+`Certificate` can also be a string containing what that file should contain.

listen.go-157-159 (1)

157-159: Logic inconsistent with documented behavior for TLSConfigFunc.

The comment on lines 57-59 states that TLSConfigFunc receives a potentially nil tlsConfig so the user can "react to this." However, the current condition cfg.TLSProvider != nil prevents TLSConfigFunc from being called when no provider is set.

Consider whether TLSConfigFunc should be invoked unconditionally (or only when set), allowing users to handle cases where no TLS config exists:

-	if cfg.TLSProvider != nil && cfg.TLSConfigFunc != nil {
+	if cfg.TLSConfigFunc != nil {
 		cfg.TLSConfigFunc(tlsConfig)
 	}

Alternatively, if the current behavior is intentional, update the documentation to clarify that TLSConfigFunc is only called when TLSProvider is set.

addon/verifypeer/ocsp_responder_test.go-288-292 (1)

288-292: Potential nil pointer dereference if PEM decode fails.

If the file doesn't contain valid PEM data, pem.Decode returns nil for block, causing a panic on line 289:

 	block, _ := pem.Decode(ct)
+	if block == nil {
+		return nil, errors.New("failed to decode PEM block from certificate file")
+	}
 	cert, err := x509.ParseCertificate(block.Bytes)

The same issue exists in parseKeyFile at lines 302-303.

addon/verifypeer/cert_test.go (2)

64-66: Missing t.Parallel() call.

Per coding guidelines, tests should invoke t.Parallel() at the start to maximize concurrency.

📝 Suggested fix

 func Test_Cert_File(t *testing.T) {
+	t.Parallel()
 	testCert(t, "../../.github/testdata/pki/intermediate/cacert.pem")
 }

---

68-72: Missing t.Parallel() call.

Per coding guidelines, tests should invoke t.Parallel() at the start to maximize concurrency.

📝 Suggested fix

 func Test_Cert_Content(t *testing.T) {
+	t.Parallel()
 	cert, err := os.ReadFile(filepath.Clean("../../.github/testdata/pki/intermediate/cacert.pem"))
 	require.NoError(t, err)
 	testCert(t, string(cert))
 }

addon/verifypeer/crl.go (2)

109-119: Consider adding a defensive bounds check.

While verifiedChains should be non-empty when VerifyPeerCertificate is called after chain verification with RequireAndVerifyClientCert, a defensive check improves robustness.

♻️ Optional defensive check

 	if clientCRL != nil {
 		config.VerifyPeerCertificate = func(_ [][]byte, verifiedChains [][]*x509.Certificate) error {
+			if len(verifiedChains) == 0 || len(verifiedChains[0]) == 0 {
+				return errors.New("tls: no verified certificate chain")
+			}
 			cert := verifiedChains[0][0]
 			for _, revokedCertificate := range clientCRL.RevokedCertificateEntries {
 				if revokedCertificate.SerialNumber.Cmp(cert.SerialNumber) == 0 {
-					return errors.New("tls: lhe certificate was revoked")
+					return errors.New("tls: the certificate was revoked")
 				}
 			}
 			return nil
 		}
 	}

---

88-97: Silent CRL fetch failures from distribution points.

When RevocationList is empty, CRL fetch failures from CRLDistributionPoints are silently ignored. This might mask configuration issues. Consider logging a warning when all distribution point fetches fail.

addon/verifypeer/crl_test.go (3)

66-68: Missing t.Parallel() call.

Per coding guidelines, tests should invoke t.Parallel() at the start to maximize concurrency.

📝 Suggested fix

 func Test_CRL_File(t *testing.T) {
+	t.Parallel()
 	testCRL(t, "../../.github/testdata/pki/intermediate/crl.pem")
 }

---

70-75: Missing t.Parallel() call.

📝 Suggested fix

 func Test_CRL_Content(t *testing.T) {
+	t.Parallel()
 	crlFile, err := os.ReadFile(filepath.Clean("../../.github/testdata/pki/intermediate/crl.pem"))
 	require.NoError(t, err)
 
 	testCRL(t, string(crlFile))
 }

---

77-105: Missing t.Parallel() call.

📝 Suggested fix

 func Test_CRL_Server(t *testing.T) {
+	t.Parallel()
 	var network string

tls_provider.go (2)

42-44: Consider avoiding mutation of receiver fields.

ProvideServerTLS() mutates p.TLSMinVersion when defaulting. This side effect could surprise callers who inspect the provider after calling the method. Consider using a local variable instead:

+	minVersion := p.TLSMinVersion
+	if minVersion == 0 {
+		minVersion = tls.VersionTLS12
+	}
-	if p.TLSMinVersion == 0 {
-		p.TLSMinVersion = tls.VersionTLS12
-	}
-
-	if p.TLSMinVersion != tls.VersionTLS12 && p.TLSMinVersion != tls.VersionTLS13 {
+	if minVersion != tls.VersionTLS12 && minVersion != tls.VersionTLS13 {
 		return nil, errors.New("tls: unsupported TLS version, please use tls.VersionTLS12 or tls.VersionTLS13")
 	}

The same pattern applies to ServerCertificateProvider.ProvideServerTLS() at lines 99-101.

---

136-141: Redundant MinVersion assignment.

Line 137 sets tlsConfig.MinVersion again, but setCert() (lines 108-112) already sets it. Remove the redundant assignment:

 	if tlsConfig != nil {
-		tlsConfig.MinVersion = p.TLSMinVersion
 		tlsHandler := &TLSHandler{}
 		tlsConfig.GetCertificate = tlsHandler.GetClientInfo
 		return tlsConfig, nil
 	}

addon/verifypeer/ocsp_responder_test.go (1)

132-133: Unnecessary error wrapping without context.

fmt.Errorf("%w", err) adds no additional context. Either return the error directly or add a descriptive message:

-	return nil, fmt.Errorf("%w", err)
+	return nil, err

Or with context:

-	return nil, fmt.Errorf("%w", err)
+	return nil, fmt.Errorf("failed to parse OCSP request: %w", err)

This pattern appears throughout the file (lines 187, 196, 207, 210, 223, 239, 279, 286, 291, 300, 305).

addon/verifypeer/ocsp.go (2)

64-67: Fail fast on invalid explicit OCSPServer configuration.

When m.OCSPServer is explicitly provided but invalid, the validation error is silently ignored, which could mask misconfiguration and weaken security. Return the error instead.

🐛 Proposed fix

 	if m.OCSPServer != "" {
-		if err := m.validateOSCPServer(m.OCSPServer); err == nil {
-			ocspServer = m.OCSPServer
+		if err := m.validateOCSPServer(m.OCSPServer); err != nil {
+			return err
 		}
+		ocspServer = m.OCSPServer
 	} else {

---

83-89: Guard against nil TLSProvider for HTTPS OCSP endpoints.

When ocspURL.Scheme == "https" and m.TLSProvider is nil, line 84 will panic with a nil pointer dereference. Add a nil check before calling ProvideClientTLS.

🐛 Proposed fix

 		if ocspURL.Scheme == "https" {
+			if m.TLSProvider == nil {
+				return errors.New("mtls: TLSProvider is required for https OCSP server")
+			}
 			tlsConfig, err := m.TLSProvider.ProvideClientTLS()
 			if err != nil {
 				return err
 			}
 			cc.SetTLSConfig(tlsConfig)
 		}

tls_provider.go (3)

17-17: Typo in documentation: "Implentations" → "Implementations".

-	// NOTE: Implentations may return (nil, nil) if no tls.Config can be provided and no error occurred.
+	// NOTE: Implementations may return (nil, nil) if no tls.Config can be provided and no error occurred.

---

42-44: Avoid mutating the receiver's state.

Directly assigning p.TLSMinVersion = tls.VersionTLS12 modifies the receiver, which could cause unexpected behavior if the provider is reused or inspected after calling ProvideServerTLS(). Consider using a local variable instead.

♻️ Proposed fix

 func (p *ACMECertificateProvider) ProvideServerTLS() (*tls.Config, error) {
 	var tlsConfig *tls.Config
+	minVersion := p.TLSMinVersion

-	if p.TLSMinVersion == 0 {
-		p.TLSMinVersion = tls.VersionTLS12
+	if minVersion == 0 {
+		minVersion = tls.VersionTLS12
 	}

-	if p.TLSMinVersion != tls.VersionTLS12 && p.TLSMinVersion != tls.VersionTLS13 {
+	if minVersion != tls.VersionTLS12 && minVersion != tls.VersionTLS13 {
 		return nil, errors.New("tls: unsupported TLS version, please use tls.VersionTLS12 or tls.VersionTLS13")
 	}
 	if p.AutoCertManager != nil {
 		tlsConfig = &tls.Config{ //nolint:gosec // This is a user input
-			MinVersion:     p.TLSMinVersion,
+			MinVersion:     minVersion,
 			GetCertificate: p.AutoCertManager.GetCertificate,
 			NextProtos:     []string{"http/1.1", "acme-tls/1"},
 		}
 	}

---

99-101: Same mutation concern as ACMECertificateProvider.

This method also mutates p.TLSMinVersion directly. Apply the same local-variable pattern for consistency.

addon/verifypeer/ocsp.go (4)

19-19: Incorrect interface name in documentation.

The comment references ServerCertificateCustomizer but the implemented interface is ServerTLSCustomizer.

-// MutualTLSWithOCSPCustomizer is a struct implementing [fiber.ServerCertificateCustomizer].
+// MutualTLSWithOCSPCustomizer is a struct implementing [fiber.ServerTLSCustomizer].

---

39-40: Documentation mismatch: default is 10 seconds, not 1.

The comment says 1 * time.Seconds but line 54 sets the default to 10 * time.Second.

-	// Default: 1 * time.Seconds
+	// Default: 10 * time.Second
 	Timeout time.Duration `json:"timeout"`

---

91-92: Add defensive bounds check on verifiedChains.

Accessing verifiedChains[0][0] without checking if the slice is non-empty could panic in edge cases. While the TLS library typically ensures at least one chain exists, a defensive check improves robustness.

♻️ Proposed fix

 		config.VerifyPeerCertificate = func(_ [][]byte, verifiedChains [][]*x509.Certificate) error {
+			if len(verifiedChains) == 0 || len(verifiedChains[0]) == 0 {
+				return errors.New("mtls: no verified certificate chain")
+			}
 			cert := verifiedChains[0][0]

---

132-132: Typo in method name: "OSCP" → "OCSP".

The method name validateOSCPServer has a transposition error. Should be validateOCSPServer to match the standard OCSP (Online Certificate Status Protocol) acronym.

addon/verifypeer/crl.go (3)

19-19: Incorrect interface name in documentation.

Same issue as in ocsp.go - the comment references ServerCertificateCustomizer but the implemented interface is ServerTLSCustomizer.

-// MutualTLSWithCRLCustomizer is a struct implementing [fiber.ServerCertificateCustomizer].
+// MutualTLSWithCRLCustomizer is a struct implementing [fiber.ServerTLSCustomizer].

---

46-47: Minor typo: "time.Seconds" → "time.Second".

-	// Default: 10 * time.Seconds
+	// Default: 10 * time.Second
 	Timeout time.Duration `json:"timeout"`

---

109-110: Add defensive bounds check on verifiedChains.

Same concern as in ocsp.go - add a check before accessing verifiedChains[0][0].

♻️ Proposed fix

 	if clientCRL != nil {
 		config.VerifyPeerCertificate = func(_ [][]byte, verifiedChains [][]*x509.Certificate) error {
+			if len(verifiedChains) == 0 || len(verifiedChains[0]) == 0 {
+				return errors.New("tls: no verified certificate chain")
+			}
 			cert := verifiedChains[0][0]

addon/verifypeer/crl.go (2)

117-127: Add defensive bounds check in VerifyPeerCertificate callback.

The callback directly accesses verifiedChains[0][0] without verifying that the slices are non-empty. While with RequireAndVerifyClientCert the chains should be populated, adding a defensive check prevents potential panics from unexpected edge cases.

Proposed fix

 	if clientCRL != nil {
 		config.VerifyPeerCertificate = func(_ [][]byte, verifiedChains [][]*x509.Certificate) error {
+			if len(verifiedChains) == 0 || len(verifiedChains[0]) == 0 {
+				return errors.New("tls: no verified certificate chains")
+			}
 			cert := verifiedChains[0][0]
 			for _, revokedCertificate := range clientCRL.RevokedCertificateEntries {
 				if revokedCertificate.SerialNumber.Cmp(cert.SerialNumber) == 0 {
 					return errors.New("tls: the certificate was revoked")
 				}
 			}
 			return nil
 		}
 	}

---

93-102: Silent fallback when CRL distribution point fetches fail.

When RevocationList is not explicitly configured and fetching from all CRLDistributionPoints fails, the connection proceeds without any revocation checking. This fail-open behavior could allow revoked certificates to authenticate successfully.

Consider either:

1. Documenting this behavior explicitly in the struct/method comments
2. Adding a FailOnCRLUnavailable bool field to optionally enforce fail-closed behavior

Is this fail-open behavior intentional? If users expect revocation checking when a CA has distribution points configured, silent failures could be a security gap.

client/tls_provider.go (2)

13-21: Fix typos in ClientTLSProvider docs.

Line 15 and Line 18 still refer to ProviderClientTLSConfig and “Implentations”. These should match the method name and correct spelling.

📝 Proposed fix

-	// ProviderClientTLSConfig provides possibly a *tls.Config object to be used by a client or
+	// ProvideClientTLS provides possibly a *tls.Config object to be used by a client or
@@
-	// NOTE: Implentations may return (nil, nil) if no tls.Config can be provided and no error occurred.
+	// NOTE: Implementations may return (nil, nil) if no tls.Config can be provided and no error occurred.

---

34-43: Correct wording in field comments.

Line 37 uses “authentificate” and Line 42 has a double space. Please fix the wording.

📝 Proposed fix

-	// permitting to authentificate a remote server.
+	// permitting to authenticate a remote server.
@@
-	// IncludeSystemCertificates allows to  inherit CA certificates from the system.
+	// IncludeSystemCertificates allows to inherit CA certificates from the system.

addon/verifypeer/crl.go (2)

46-47: Typo in default timeout comment.

Use time.Second, not time.Seconds.

📝 Proposed fix

-	// Default: 10 * time.Seconds
+	// Default: 10 * time.Second

---

162-170: Check HTTP status before parsing the CRL response.

Non-2xx responses should surface as HTTP errors, not PEM parse failures.

🐛 Proposed fix

 	resp, err := cc.Get(distURL.String())
 	if err != nil {
 		return []byte{}, fmt.Errorf("tls: unable to fetch certificate revocation list from url=%q: %w", distURL.String(), err)
 	}
 
+	if resp.StatusCode() < 200 || resp.StatusCode() >= 300 {
+		return []byte{}, fmt.Errorf("tls: failed to fetch CRL from url=%q: HTTP status %d", distURL.String(), resp.StatusCode())
+	}
+
 	if bytes, ok := m.decodePemCrl(resp.Body()); ok {
 		return bytes, nil
 	}

addon/verifypeer/crl.go (1)

117-126: Preserve any existing VerifyPeerCertificate hook.

Setting config.VerifyPeerCertificate here overwrites any prior customizer (e.g., OCSP). Consider chaining the previous hook so multiple customizers compose instead of clobbering.

♻️ Proposed refactor

 	if clientCRL != nil {
-		config.VerifyPeerCertificate = func(_ [][]byte, verifiedChains [][]*x509.Certificate) error {
+		prevVerify := config.VerifyPeerCertificate
+		config.VerifyPeerCertificate = func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
+			if prevVerify != nil {
+				if err := prevVerify(rawCerts, verifiedChains); err != nil {
+					return err
+				}
+			}
 			cert := verifiedChains[0][0]
 			for _, revokedCertificate := range clientCRL.RevokedCertificateEntries {
 				if revokedCertificate.SerialNumber.Cmp(cert.SerialNumber) == 0 {
 					return errors.New("tls: the certificate was revoked")
 				}
 			}
 			return nil
 		}
 	}

client/tls_provider.go (1)

56-107: LGTM with one minor suggestion.

The TLS configuration logic is well-structured with proper error propagation. The approach of using the same file for both cert and key parameters in X509KeyPair/LoadX509KeyPair is correct since the Certificate field is documented to contain both certificate and key in PEM format.

📝 Minor: Consider aligning error message with field name

The error messages reference "CertificateChain" but the field is named "Certificate":

-			return nil, fmt.Errorf("clienttls: cannot load TLS key pair from CertificateChain: %w", err)
+			return nil, fmt.Errorf("clienttls: cannot load TLS key pair from Certificate: %w", err)

-		return nil, fmt.Errorf("clienttls: cannot load TLS key pair from CertificateChain: %w", err)
+		return nil, fmt.Errorf("clienttls: cannot load TLS key pair from Certificate: %w", err)

addon/verifypeer/ocsp.go (1)

105-111: Consider adding a defensive bounds check on verifiedChains.

While Go's TLS stack guarantees verifiedChains is non-empty when RequireAndVerifyClientCert is set, a defensive check would make the code more robust against unexpected edge cases.

♻️ Proposed defensive check

 	config.VerifyPeerCertificate = func(_ [][]byte, verifiedChains [][]*x509.Certificate) error {
+		if len(verifiedChains) == 0 || len(verifiedChains[0]) == 0 {
+			return errors.New("mtls: no verified certificate chain")
+		}
 		cert := verifiedChains[0][0]
 		opts := &ocsp.RequestOptions{Hash: crypto.SHA256}

addon/verifypeer/ocsp_responder_test.go (1)

146-158: Use structured logging format for consistency.

The log.Info and log.Warn calls at lines 147, 150, and 270 use printf-style formatting (e.g., log.Info("Found entry %+v", ent)), but Fiber's logger typically expects structured arguments. Consider using log.Infof or log.Infow for format strings.

♻️ Proposed fix

-		log.Info("Found entry %+v", ent)
+		log.Infof("Found entry %+v", ent)
 		switch ent.Status {
 		case StatusRevoked:
-			log.Warn("This certificate is revoked")
+			log.Warnf("This certificate is revoked")

addon/verifypeer/cert_test.go (1)

29-47: Consider using a channel for server readiness instead of sleep.

The time.Sleep(500 * time.Millisecond) at line 45 is fragile—under heavy load, the server may not be ready in time. Consider using a channel signaled from ListenerAddrFunc to ensure the server is actually listening before proceeding with client requests.

Additionally, the assert.NoError in the goroutine (line 30) may not properly fail the test if the assertion fails.

♻️ Proposed improvement

 func testCert(t *testing.T, cert string) {
 	t.Helper()
-	var network string
+	ready := make(chan string, 1)
+	listenErr := make(chan error, 1)

 	// App
 	app := fiber.New()
 	app.Use(logger.New())
 	app.Get("/", func(c fiber.Ctx) error {
 		return c.SendString("Hello")
 	})
 	go func() {
-		assert.NoError(t, app.Listen(":0", fiber.ListenConfig{
+		listenErr <- app.Listen(":0", fiber.ListenConfig{
 			DisableStartupMessage: true,
 			ListenerNetwork:       fiber.NetworkTCP4,
 			ListenerAddrFunc: func(addr net.Addr) {
-				network = addr.String()
+				ready <- addr.String()
 			},
 			// ...
-		}))
+		})
 	}()

-	time.Sleep(500 * time.Millisecond)
-	appPort, found := strings.CutPrefix(network, "0.0.0.0:")
+	network := <-ready
+	appPort, found := strings.CutPrefix(network, "0.0.0.0:")
 	require.True(t, found)

addon/verifypeer/crl_test.go (4)

66-68: Missing t.Parallel() call.

Per coding guidelines, Go tests should invoke t.Parallel() at the start of each test to maximize concurrency.

Proposed fix

 func Test_CRL_File(t *testing.T) {
+	t.Parallel()
 	testCRL(t, "../../.github/testdata/pki/intermediate/crl.pem")
 }

---

70-75: Missing t.Parallel() call.

Per coding guidelines, Go tests should invoke t.Parallel() at the start of each test.

Proposed fix

 func Test_CRL_Content(t *testing.T) {
+	t.Parallel()
 	crlFile, err := os.ReadFile(filepath.Clean("../../.github/testdata/pki/intermediate/crl.pem"))
 	require.NoError(t, err)

 	testCRL(t, string(crlFile))
 }

---

77-105: Missing t.Parallel() call.

Per coding guidelines, Go tests should invoke t.Parallel() at the start of each test.

Proposed fix

 func Test_CRL_Server(t *testing.T) {
+	t.Parallel()
 	var network string

---

47-49: Consider replacing time.Sleep with a synchronization primitive.

Using time.Sleep for server startup synchronization can cause flaky tests. Consider using a channel or sync.WaitGroup to signal when the server is ready.

Example using a channel

+	ready := make(chan struct{})
 	go func() {
 		assert.NoError(t, app.Listen(":0", fiber.ListenConfig{
 			DisableStartupMessage: true,
 			ListenerNetwork:       fiber.NetworkTCP4,
 			ListenerAddrFunc: func(addr net.Addr) {
 				network = addr.String()
+				close(ready)
 			},
 			TLSProvider: &fiber.ServerCertificateProvider{
 				Certificate: "../../.github/testdata/pki/intermediate/server/fullchain.pem",
 			},
 			TLSCustomizer: &verifypeer.MutualTLSWithCRLCustomizer{
 				Certificate:    "../../.github/testdata/pki/intermediate/cacert.pem",
 				RevocationList: crl,
 			},
 		}))
 	}()

-	time.Sleep(500 * time.Millisecond)
+	<-ready

docs/addon/verifypeer.md (1)

7-8: Fix grammar in the VerifyPeer introduction.

The sentence is ungrammatical and has a spacing error around *tls.Config's.

✏️ Suggested edit

-The VerifyPeer addon package aim is to provides additional `fiber.ServerTLSCustomizer` interface implementations to add means
-to configure a `*tls.Config` 's `VerifyPeerCertificate` field with additional validation for client mTLS connection.
+The VerifyPeer addon package aims to provide additional `fiber.ServerTLSCustomizer` interface implementations to configure
+a `*tls.Config`'s `VerifyPeerCertificate` field with additional validation for client mTLS connections.

Please run make markdown after updating the docs. As per coding guidelines.

addon/verifypeer/crl.go (1)

52-53: Fix interface name in CustomizeServerTLS docstring.

✏️ Suggested edit

-// CustomizeServerTLS implements [fiber.ServerCertificateCustomizer]
+// CustomizeServerTLS implements [fiber.ServerTLSCustomizer]

addon/verifypeer/listen_test.go (1)

70-73: Assertions in goroutines may not fail the test properly.

Using assert.NoError inside a goroutine won't reliably fail the test because the goroutine may outlive the test function. The first test (Test_Listen_MutualTLS) correctly uses a channel pattern. Apply the same pattern here for consistency.

♻️ Suggested fix

+	shutdownErr := make(chan error, 1)
 	go func() {
 		time.Sleep(1000 * time.Millisecond)
-		assert.NoError(t, app.Shutdown())
+		shutdownErr <- app.Shutdown()
 	}()
 
 	require.NoError(t, app.Listen(":0", fiber.ListenConfig{
 		// ...
 	}))
+	require.NoError(t, <-shutdownErr)

The same issue exists in Test_Listen_MutualTLS_Prefork (lines 109-112) and Test_Listen_MutualTLS_Prefork_Deprecated (lines 149-152).

client/client.go (1)

247-257: Avoid holding the client lock during provider I/O and skip nil configs.

ProvideClientTLS may perform I/O; holding c.mu can block unrelated setters. Also, the interface allows (nil, nil)—currently that clears any existing TLS config. If that’s not intended, guard config != nil and apply under the lock only after the provider call.

♻️ Suggested refactor

 func (c *Client) SetTLSProvider(provider ClientTLSProvider) *Client {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if provider != nil {
-		if config, err := provider.ProvideClientTLS(); err != nil {
-			c.logger.Panicf("client: unable to set tlsConfig: %v", err)
-		} else {
-			c.applyTLSConfig(config)
-		}
-	}
+	if provider == nil {
+		return c
+	}
+	config, err := provider.ProvideClientTLS()
+	if err != nil {
+		c.logger.Panicf("client: unable to set tlsConfig: %v", err)
+		return c
+	}
+	if config == nil {
+		return c
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.applyTLSConfig(config)
 	return c
 }

client/tls_provider.go (1)

56-76: Avoid mutating provider state inside ProvideClientTLS.

Mutating p.TLSMinVersion can introduce data races if the provider is reused across goroutines. Prefer a local default.

♻️ Suggested refactor

-	if p.TLSMinVersion == 0 {
-		p.TLSMinVersion = tls.VersionTLS12
-	}
+	minVersion := p.TLSMinVersion
+	if minVersion == 0 {
+		minVersion = tls.VersionTLS12
+	}
@@
-			tlsConfig = &tls.Config{ //nolint:gosec // This is a user input
-				MinVersion: p.TLSMinVersion,
+			tlsConfig = &tls.Config{ //nolint:gosec // This is a user input
+				MinVersion: minVersion,
 			}

docs/client/rest.md (1)

376-406: Minor grammar fix needed.

Line 399 is missing a comma for proper sentence structure.

-If the server can be authenticated using one of the system root certificates, you can also load them :
+If the server can be authenticated using one of the system root certificates, you can also load them:

Also, as per coding guidelines, please run make markdown to lint all Markdown files after updating.

tls_provider.go (1)

42-44: Consider avoiding mutation of receiver fields.

Both ACMECertificateProvider.ProvideServerTLS() and ServerCertificateProvider.ProvideServerTLS() mutate p.TLSMinVersion when it's zero. This side effect could cause unexpected behavior if the provider instance is reused or inspected after calling ProvideServerTLS().

Consider using a local variable instead:

♻️ Suggested refactor for ACMECertificateProvider

 func (p *ACMECertificateProvider) ProvideServerTLS() (*tls.Config, error) {
 	var tlsConfig *tls.Config
+	tlsMinVersion := p.TLSMinVersion
 
-	if p.TLSMinVersion == 0 {
-		p.TLSMinVersion = tls.VersionTLS12
+	if tlsMinVersion == 0 {
+		tlsMinVersion = tls.VersionTLS12
 	}
 
-	if p.TLSMinVersion != tls.VersionTLS12 && p.TLSMinVersion != tls.VersionTLS13 {
+	if tlsMinVersion != tls.VersionTLS12 && tlsMinVersion != tls.VersionTLS13 {
 		return nil, errors.New("tls: unsupported TLS version, please use tls.VersionTLS12 or tls.VersionTLS13")
 	}
 	if p.AutoCertManager != nil {
 		tlsConfig = &tls.Config{
-			MinVersion:     p.TLSMinVersion,
+			MinVersion:     tlsMinVersion,
 			GetCertificate: p.AutoCertManager.GetCertificate,
 			NextProtos:     []string{"http/1.1", "acme-tls/1"},
 		}
 	}

Apply a similar pattern to ServerCertificateProvider.

Also applies to: 99-101

addon/verifypeer/listen_test.go (1)

16-19: Using go:linkname to access internal test variables is fragile.

While go:linkname works, it couples this test to the internal implementation of the fiber package. If testPreforkMaster is renamed or removed, these tests will fail at link time with a cryptic error. Consider whether there's a cleaner way to test prefork behavior, such as exposing a test helper function.

addon/verifypeer/cert_test.go (1)

45-47: Race condition: time.Sleep is unreliable for server startup synchronization.

The test uses time.Sleep(500ms) to wait for the server to start, but ListenerAddrFunc is already being used to capture the address. Consider using a channel to signal when the listener is ready:

♻️ Suggested fix

+	ready := make(chan struct{})
 	go func() {
 		assert.NoError(t, app.Listen(":0", fiber.ListenConfig{
 			DisableStartupMessage: true,
 			ListenerNetwork:       fiber.NetworkTCP4,
 			ListenerAddrFunc: func(addr net.Addr) {
 				network = addr.String()
+				close(ready)
 			},
 			// ...
 		}))
 	}()
 
-	time.Sleep(500 * time.Millisecond)
+	<-ready
 	appPort, found := strings.CutPrefix(network, "0.0.0.0:")

listen.go (1)

142-159: Consider warning or erroring when TLSCustomizer is set but TLSProvider returns nil.

When TLSProvider.ProvideServerTLS() returns (nil, nil) (which is valid per the interface contract), the TLSCustomizer is silently skipped because of the if tlsConfig != nil check. This could lead to confusing behavior where users set a customizer expecting it to run, but it never does.

Consider logging a warning or returning an error when TLSCustomizer is set but tlsConfig is nil:

♻️ Suggested enhancement

 	if tlsConfig != nil {
 		if cfg.TLSCustomizer != nil {
 			if err := cfg.TLSCustomizer.CustomizeServerTLS(tlsConfig); err != nil {
 				return err
 			}
 		}
+	} else if cfg.TLSCustomizer != nil {
+		log.Warn("TLSCustomizer is set but TLSProvider returned nil config; customizer will not be applied")
 	}

listen_test.go (1)

187-208: Consider adding t.Parallel() for test concurrency.

This test binds to port :0 and uses an in-memory shutdown pattern, making it safe for parallel execution. Per coding guidelines, tests should invoke t.Parallel() at the start.

Suggested fix

 func Test_App_Listener_TLS_Listener(t *testing.T) {
+	t.Parallel()
 	// Create tls certificate
 	cer, err := tls.LoadX509KeyPair("./.github/testdata/pki/intermediate/server/cert.pem", "./.github/testdata/pki/intermediate/server/key.pem")

docs/whats_new.md (1)

192-192: Minor grammar improvement for readability.

Consider reordering for natural English phrasing.

Suggested fix

-We provide now two interfaces and implementations to let you configure TLS in `ListenConfig`:
+We now provide two interfaces and implementations to let you configure TLS in `ListenConfig`:

addon/verifypeer/ocsp_responder_test.go (1)

131-133: Redundant error wrapping with fmt.Errorf("%w", err).

Using fmt.Errorf("%w", err) without additional context is redundant—it creates a new error that wraps the original without adding information. Either add meaningful context or return the error directly.

Example fix for one occurrence

 	req, err := ocsp.ParseRequest(rawreq)
 	if err != nil {
-		return nil, fmt.Errorf("%w", err)
+		return nil, fmt.Errorf("parse OCSP request: %w", err)
 	}

Or simply:

 	req, err := ocsp.ParseRequest(rawreq)
 	if err != nil {
-		return nil, fmt.Errorf("%w", err)
+		return nil, err
 	}

Also applies to: 186-188, 195-197, 206-208, 209-211, 222-224, 238-240, 285-287, 290-292, 299-301, 304-306

docs/api/fiber.md (1)

218-222: Replace hard tab with spaces in interface code block.

Markdownlint flags a hard tab at line 220. As noted in past reviews, please run make markdown after updating the docs.

Proposed fix

 ```go title="Signature"
 type ServerTLSCustomizer interface {
-	  CustomizeServerTLS(config *tls.Config) error
+    CustomizeServerTLS(config *tls.Config) error
 }

</details>

</blockquote></details>
<details>
<summary>docs/addon/verifypeer.md (1)</summary><blockquote>

`7-8`: **Fix grammar in the introduction.**

The sentence has grammatical issues: "aim is to provides" should be "aims to provide".


<details>
<summary>Proposed fix</summary>

```diff
-The VerifyPeer addon package aim is to provides additional `fiber.ServerTLSCustomizer` interface implementations to add means
-to configure a `*tls.Config` 's `VerifyPeerCertificate` field with additional validation for client mTLS connection.
+The VerifyPeer addon package aims to provide additional `fiber.ServerTLSCustomizer` interface implementations
+to configure a `*tls.Config`'s `VerifyPeerCertificate` field with additional validation for client mTLS connections.

As per coding guidelines, please run make markdown after updating the docs.

tls_provider_test.go (1)

108-109: Restore testPreforkMaster after prefork tests.

testPreforkMaster is a package-level flag; setting it without restoring leaks state across tests and can race once tests run in parallel. Capture the prior value and restore it via t.Cleanup().

🔧 Suggested fix (apply to each prefork test)

func Test_ServerTLSProvider_Prefork(t *testing.T) {
-	testPreforkMaster = true
+	prevPreforkMaster := testPreforkMaster
+	testPreforkMaster = true
+	t.Cleanup(func() { testPreforkMaster = prevPreforkMaster })

Also applies to: 137-138

listen_test.go (1)

187-208: Consider adding t.Parallel() to this test.

Per coding guidelines, tests should invoke t.Parallel() at the start. This test doesn't have shared state that would prevent parallel execution.

Suggested change

 func Test_App_Listener_TLS_Listener(t *testing.T) {
+	t.Parallel()
 	// Create tls certificate
 	cer, err := tls.LoadX509KeyPair("./.github/testdata/pki/intermediate/server/cert.pem", "./.github/testdata/pki/intermediate/server/key.pem")

addon/verifypeer/cert.go (2)

25-28: Fix typos in doc comments.

Minor typos in the documentation: "parse" should be "parses" and "certiticate" should be "certificate".

Suggested fix

 // CustomizeServerTLS implements [fiber.ServerTLSCustomizer].
 //
-// It parse the ClientCertificate, either a file path or its content, a PEM encoded CA certificate.
-// It will add the certiticate to config.ClientCAs and set config.ClientAuth to tls.RequireAndVerifyClientCert
+// It parses the ClientCertificate, either a file path or its content, a PEM encoded CA certificate.
+// It will add the certificate to config.ClientCAs and set config.ClientAuth to tls.RequireAndVerifyClientCert

---

44-68: ClientCertificate() can return (nil, nil) silently.

When Certificate is empty, or the PEM block type is not "CERTIFICATE", this method returns (nil, nil). While CustomizeServerTLS handles this gracefully (returns early at line 33-34), callers using ClientCertificate() directly should be aware of this behavior.

Consider returning an error for the case when the PEM block exists but has an unexpected type, as this likely indicates misconfiguration rather than an intentional empty value.

Suggested improvement

 	if block != nil && block.Type == "CERTIFICATE" {
 		cert, err := x509.ParseCertificate(block.Bytes)
 		if err != nil {
 			return nil, fmt.Errorf("tls: cannot load client CA certificate: %w", err)
 		}
 		certificate = cert
+	} else if block != nil {
+		return nil, fmt.Errorf("tls: unexpected PEM block type %q, expected CERTIFICATE", block.Type)
 	}

addon/verifypeer/ocsp.go (2)

101-106: Guard against empty verifiedChains to prevent potential panic.

While VerifyPeerCertificate is typically called with verified chains when ClientAuth is RequireAndVerifyClientCert, accessing verifiedChains[0][0] without bounds checking could panic in edge cases.

Defensive check

 		config.VerifyPeerCertificate = func(_ [][]byte, verifiedChains [][]*x509.Certificate) error {
+			if len(verifiedChains) == 0 || len(verifiedChains[0]) == 0 {
+				return errors.New("mtls: no verified certificate chain")
+			}
 			cert := verifiedChains[0][0]
 			opts := &ocsp.RequestOptions{Hash: crypto.SHA256}

---

142-148: Typo in function name: validateOSCPServer should be validateOCSPServer.

The function name has a typo - "OSCP" should be "OCSP" (Online Certificate Status Protocol).

Fix typo

-func (*MutualTLSWithOCSPCustomizer) validateOSCPServer(ocspServer string) error {
+func (*MutualTLSWithOCSPCustomizer) validateOCSPServer(ocspServer string) error {

Also update the call sites at lines 71 and 77.

addon/verifypeer/crl.go (3)

52-53: Fix interface name in doc comment.

The doc comment still references fiber.ServerCertificateCustomizer, but the interface is fiber.ServerTLSCustomizer.

Fix

-// CustomizeServerTLS implements [fiber.ServerCertificateCustomizer]
+// CustomizeServerTLS implements [fiber.ServerTLSCustomizer]

---

117-127: Add bounds check for verifiedChains to prevent potential panic.

Same issue as in ocsp.go - accessing verifiedChains[0][0] without checking bounds could panic.

Defensive check

 	if clientCRL != nil {
 		config.VerifyPeerCertificate = func(_ [][]byte, verifiedChains [][]*x509.Certificate) error {
+			if len(verifiedChains) == 0 || len(verifiedChains[0]) == 0 {
+				return errors.New("tls: no verified certificate chain")
+			}
 			cert := verifiedChains[0][0]
 			for _, revokedCertificate := range clientCRL.RevokedCertificateEntries {

---

93-101: Silent failure when fetching CRL from distribution points may mask issues.

When RevocationList is empty, the code attempts to fetch CRL from CRLDistributionPoints but silently ignores all failures. This could leave the server without CRL protection without any indication. Consider logging a warning when all distribution points fail.

Add logging for visibility

+	var fetchErrors []error
 	} else {
 		for _, dist := range clientCACert.CRLDistributionPoints {
 			if distURL, err := m.validateFetchURL(dist); err == nil {
 				if crl, err := m.fetchCRL(distURL); err == nil {
 					crlBytes = crl
 					break
+				} else {
+					fetchErrors = append(fetchErrors, err)
 				}
 			}
 		}
+		if len(crlBytes) == 0 && len(fetchErrors) > 0 {
+			// Consider logging: CRL fetch failed from all distribution points
+		}
 	}

addon/verifypeer/crl_test.go (3)

66-68: Add t.Parallel() to each test function.

Per coding guidelines, all Go tests should invoke t.Parallel() at the start to maximize concurrency.

Proposed fix

 func Test_CRL_File(t *testing.T) {
+	t.Parallel()
 	testCRL(t, "../../.github/testdata/pki/intermediate/crl.pem")
 }

 func Test_CRL_Content(t *testing.T) {
+	t.Parallel()
 	crlFile, err := os.ReadFile(filepath.Clean("../../.github/testdata/pki/intermediate/crl.pem"))
 	require.NoError(t, err)

 	testCRL(t, string(crlFile))
 }

 func Test_CRL_Server(t *testing.T) {
+	t.Parallel()
 	var network string

Also applies to: 70-75, 77-105

---

30-45: Avoid assert inside goroutines; use t.Errorf or channel-based error propagation.

Per retrieved learnings, the linter does not allow require or assert assertions from within goroutines. Consider capturing errors via a channel or using t.Errorf.

Proposed fix

+	errCh := make(chan error, 1)
 	go func() {
-		assert.NoError(t, app.Listen(":0", fiber.ListenConfig{
+		errCh <- app.Listen(":0", fiber.ListenConfig{
 			DisableStartupMessage: true,
 			ListenerNetwork:       fiber.NetworkTCP4,
 			ListenerAddrFunc: func(addr net.Addr) {
 				network = addr.String()
 			},
 			TLSProvider: &fiber.ServerCertificateProvider{
 				Certificate: "../../.github/testdata/pki/intermediate/server/fullchain.pem",
 			},
 			TLSCustomizer: &verifypeer.MutualTLSWithCRLCustomizer{
 				Certificate:    "../../.github/testdata/pki/intermediate/cacert.pem",
 				RevocationList: crl,
 			},
-		}))
+		})
 	}()

---

47-49: Replace time.Sleep with a synchronization primitive for server readiness.

Using time.Sleep for waiting on server startup is flaky. Consider using a channel signaled from ListenerAddrFunc to wait until the listener is ready.

Example approach

ready := make(chan struct{})
ListenerAddrFunc: func(addr net.Addr) {
    network = addr.String()
    close(ready)
},
// ...
<-ready // wait for listener

client/tls_provider.go (1)

56-59: Consider avoiding mutation of the receiver struct.

Setting p.TLSMinVersion directly modifies the original ClientCertificateProvider instance. If the same provider is reused with different expectations, this could cause confusion. Consider using a local variable instead.

Proposed fix

 func (p *ClientCertificateProvider) ProvideClientTLS() (*tls.Config, error) {
-	if p.TLSMinVersion == 0 {
-		p.TLSMinVersion = tls.VersionTLS12
-	}
+	minVersion := p.TLSMinVersion
+	if minVersion == 0 {
+		minVersion = tls.VersionTLS12
+	}

 	var tlsConfig *tls.Config

 	initTLS := func() error {
 		if tlsConfig == nil {
 			tlsConfig = &tls.Config{ //nolint:gosec // This is a user input
-				MinVersion: p.TLSMinVersion,
+				MinVersion: minVersion,
 			}

docs/whats_new.md (1)

195-206: Replace hard tabs with spaces in code blocks.

Markdownlint flags hard tabs at lines 197 and 204. Please run make markdown to fix formatting. As per coding guidelines.

Proposed fix

   ```go title="Signature"
   type ServerTLSProvider interface {
-	    ProvideServerTLS() (*tls.Config, error)
+      ProvideServerTLS() (*tls.Config, error)
   }

• ServerTLSCustomizer : Add functionality to the *tls.Config object, like MutualTLS.

  type ServerTLSCustomizer interface {

•   CustomizeServerTLS(config *tls.Config) error
  

•  CustomizeServerTLS(config *tls.Config) error
  

  }

</details>

</blockquote></details>
<details>
<summary>addon/verifypeer/ocsp_test.go (1)</summary><blockquote>

`25-33`: **Propagate `Listen` errors to avoid hangs.**

If `Listen` fails before `ListenerAddrFunc` runs, the main goroutine blocks on the address channel forever. Consider wiring an error channel (or `select` with timeout) so failures surface deterministically and the test doesn’t hang.  


<details>
<summary>♻️ Sketch of a safer pattern</summary>

```diff
-	staplerAddrCh := make(chan string, 1)
+	staplerAddrCh := make(chan string, 1)
+	staplerErrCh := make(chan error, 1)
...
 	go func() {
-		assert.NoError(t, stapler.Listen(":0", fiber.ListenConfig{
+		staplerErrCh <- stapler.Listen(":0", fiber.ListenConfig{
 			DisableStartupMessage: true,
 			ListenerNetwork:       fiber.NetworkTCP4,
 			ListenerAddrFunc: func(addr net.Addr) {
 				staplerAddrCh <- addr.String()
 			},
-		}))
+		})
 	}()
-	ocspAddr := <-staplerAddrCh
+	select {
+	case ocspAddr := <-staplerAddrCh:
+		// use ocspAddr
+	case err := <-staplerErrCh:
+		require.NoError(t, err)
+	}

Also applies to: 45-60