[adulau]

The API previously only served plaintext HTTP, while RST Cloud's optional connections back to MISP disabled certificate verification by default. The resolver cache could also reuse a client across API keys or after verification was enabled.

This adds optional native HTTPS and fixes the RST verification defaults. It includes a source-based TLS/protocol review and reproducible hybrid key-exchange verification instructions.

• Add paired --tls-certfile / --tls-keyfile options for a TLS 1.3 API listener. Invalid or incomplete TLS configuration stops startup before listening; existing loopback HTTP deployments keep working. OpenAPI advertises HTTPS when enabled, and non-loopback HTTP binds produce a warning.
• Preserve OpenSSL's configured key-exchange groups so capable runtimes can negotiate hybrid ML-KEM. Document a hybrid-only OpenSSL policy, certificate validation, classical-fallback rejection checks, and proxy/website/outbound-client boundaries.
• Enable certificate verification by default for both RST MISP clients. Empty or unrecognized settings keep verification enabled; explicit false settings remain supported. Key the galaxy-resolver cache by URL, API key and verification mode, matching the write-back client's isolation.
• Document remaining plaintext protocol paths and the already-open Cytomic Orion and VMRay fixes ([critical] fix: [cytomic_orion] use .get() for API fields and stop disabling TLS verification #865, [critical] fix: [vmray] stop disabling TLS certificate verification #881), without duplicating them.

PQC scope: this establishes hybrid TLS capability and a deployment path; it does not certify every module or connection as PQC compliant. A capable runtime and compatible peer are required. Default groups can still fall back to classical key exchange. Hybrid key exchange does not provide post-quantum certificate authentication, and the API still requires trusted-network access or an authenticated proxy.

Migration: RST deployments using an untrusted/private MISP certificate must install the correct CA trust or explicitly configure misp_verifycert=false. Optional resolution/write-back retains its existing best-effort behavior on connection failure, without retrying unverified.

Validation

• 239 targeted tests passed across TLS, RST, startup/configuration, caching, statistics, PAP restrictions and HTTP tracing.
• A real Tornado HTTPS connection negotiated TLS 1.3 / X25519MLKEM768 with certificate and hostname verification; a TLS 1.2 client was rejected.
• The exact documented strict OpenSSL configuration was tested in a fresh Python process: compatible handshakes succeed and a classical-only X25519 peer is rejected.
• Regression coverage includes missing/empty/invalid TLS arguments, mismatched keys, HTTPS OpenAPI URLs, RST verification settings, certificate failure without downgrade, and client-cache isolation.
• Package-source flake8, Black/isort checks on new and changed core Python files, and git diff --check passed.

The full external-service suite and live provider negotiations were not run. MkDocs is unavailable in the review environment; the documentation build remains for CI.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T15:33:35.359534Z	23a8256	PR opened
🔒 Security Review	✅ Completed 2026-11-03T15:34:33.849270Z	23a8256	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.