security: mTLS client certificates are not enforced in Linux release binaries

Summary

The prebuilt Linux binaries published in the ttyd releases are built with Mbed TLS, and mTLS client certificate enforcement does not appear to work correctly with those binaries.

When ttyd is started with --ssl-ca, the server asks the client to provide a certificate, but if the client does not provide one, the connection is still allowed to continue. This makes mTLS effectively bypassable for users relying on the official Linux release binaries.

Impact

Users may expect --ssl-ca to require a valid client certificate before allowing access to ttyd. With the affected Linux release binaries, clients without a certificate can still connect, so deployments relying on mTLS for access control may be exposed.

Affected builds

The latest release, 1.7.7, publishes Linux binaries such as:

• ttyd.x86_64
• ttyd.aarch64
• ttyd.arm
• ttyd.armhf
• other Linux cross-build artifacts

At the 1.7.7 tag, scripts/cross-build.sh builds libwebsockets with Mbed TLS:

• MBEDTLS_VERSION=2.28.5
• -DLWS_WITH_MBEDTLS=ON

The current main branch appears to have switched the cross-build script to OpenSSL, but the published Linux release binaries are still Mbed TLS based.

Expected behavior

When ttyd is started with SSL and --ssl-ca, a client that does not provide a valid client certificate should be rejected during TLS negotiation and should not be able to access HTTP or WebSocket endpoints.

Actual behavior

The server requests a client certificate, but clients that do not provide one are still allowed to continue the connection.

Suggested fix

Please ensure release binaries enforce client certificate verification correctly when --ssl-ca is configured. If this is caused by the Mbed TLS backend or libwebsockets integration, consider rebuilding Linux release binaries with OpenSSL or otherwise disabling affected Mbed TLS release builds until mTLS enforcement is verified.