TCP gives a handler three views of a verified peer: TlsSession.PeerSubject (for people), PeerCommonName (the value to authorize on) and PeerCertificateDer (the raw certificate). QUIC gives the first two and nothing else — grep PeerCertificateDer src/protocols/ioxide.ngtcp2/ returns zero hits.
That closes off anything the two string accessors do not already answer: checking a SAN rather than the CN, reading an extension, pinning a fingerprint, or handing the certificate to X509Certificate2 and letting the application decide. On TCP that is a property read; on QUIC it cannot be done at all.
The shim already holds the peer certificate long enough to record the subject and CN during verification, so this is an export and a managed accessor rather than new plumbing. Worth mirroring the TCP accessor exactly, including that it is a snapshot rather than a live read — PeerCertificateDer is captured at verification time on purpose, and the QUIC identity accessors that read through the native connection are the ones that would otherwise need a disposed check.
TCP gives a handler three views of a verified peer:
TlsSession.PeerSubject(for people),PeerCommonName(the value to authorize on) andPeerCertificateDer(the raw certificate). QUIC gives the first two and nothing else —grep PeerCertificateDer src/protocols/ioxide.ngtcp2/returns zero hits.That closes off anything the two string accessors do not already answer: checking a SAN rather than the CN, reading an extension, pinning a fingerprint, or handing the certificate to
X509Certificate2and letting the application decide. On TCP that is a property read; on QUIC it cannot be done at all.The shim already holds the peer certificate long enough to record the subject and CN during verification, so this is an export and a managed accessor rather than new plumbing. Worth mirroring the TCP accessor exactly, including that it is a snapshot rather than a live read —
PeerCertificateDeris captured at verification time on purpose, and the QUIC identity accessors that read through the native connection are the ones that would otherwise need a disposed check.