Ilker ManapandClaude Opus 5.5
9ab081aa5a
The Redfish and Proxmox clients skipped TLS verification (BMCs ship self-signed certificates), so a host posing as a BMC on the network got the Basic-auth password. Before any credentials go to an HTTPS BMC the region now reads its certificate with a handshake-only operation (tls-fingerprint, run on the rack controller) and pins the SHA-256 on the BMC record (extra tls_fingerprint); every later connection must show the same certificate or nothing is sent. Changing the address, clearing tls_fingerprint, or a BMC firmware update run by Rollcall (new firmware often means a new certificate) pins anew. verify_tls=true still uses the system CAs instead. The lab emulator keeps its certificate like a BMC. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>