https://gitlab.synchro.net/main/sbbs/-/commit/273c64417cbdde329d3880c1
Modified Files:
src/syncterm/Manual.txt Wren.adoc bbslist.c bbslist.h menu_settings.c src/syncterm/scripts/menu_bbs_editor.wren menu_bbs_editor_test.wren menu_settings_ui.wren menu_ui.wren syncterm.wren syncterm_menu.wren ui_popup_test.wren src/syncterm/syncterm.c syncterm.h telnets.c wren_bind.c wren_bind_menu.c wren_bind_menu_settings.c src/xptls/xp_tls.h xp_tls_botan3.cpp xp_tls_none.c xp_tls_openssl.c
Log Message:
syncterm: authenticate TelnetS connections

Replace the old accept-any-certificate TelnetS path with explicit server authentication. Trust Web PKI by default, allow a per-entry certificate instead, and deliberately fail with an empty trust store when neither is selected. Keep the trust sources mutually exclusive and reject blind
trust through the configured TLS interface.

On verification failure, capture and display the presented certificate
chain with readable UTC validity dates and scrollable details. Allow
named directory entries to install a selected certificate beside the INI
file without overwriting an existing file, then bind that trust anchor to
only that entry.

Add exact-version TLS 1.2 and TLS 1.3 PSK support, record the strongest protocol previously negotiated, and require confirmation before a
downgrade. Support global and per-entry client certificate identities,
with file pickers rooted in the configuration directory and Delete
clearing configured paths.

Implement the policy consistently in the OpenSSL and Botan backends,
including hostname verification and explicitly trusted leaf or
intermediate certificates. Update the settings bindings, documentation,
and Wren regression tests for the new configuration and certificate UI.

Co-Authored-By: Codex <noreply@openai.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net