nx_tls12_handshake_gate.nx

nx_tls12_handshake_gate.nx -- SOVEREIGN, LIVE gate for PHASE 2 of the TLS 1.2 client: a FULL handshake (ECDHE-RSA-AES128-GCM-SHA256) to a real TLS-1.2-max host, proving the encrypted session works end-to-end. PRIMARY TARGET = api.porkbun.com (the real goal: a TLS-1.2-max host our 1.3-only client cannot reach; needed for nx_porkbun_set_txt -> ACME wildcard renew). The gate: 1. Loads the real Mozilla CA bundle (data/mozilla_certdata.txt) into a TrustStore. 2. Connects + runs the full handshake (production path, no fault): ClientHello -> server flight -> CERT-CHAIN VALIDATE -> SKE VERIFY -> ECDHE -> key schedule -> ClientKeyExchange + ChangeCipherSpec + encrypted client Finished -> server ChangeCipherSpec + encrypted server Finished VERIFY. MUST reach CONNECTED. 3. Over the established session sends a real GET / HTTP/1.1\r\nHost: <h>\r\nConnection: close\r\n\r\n decrypts the response, and asserts it begins with "HTTP/1.1 " (ANY status proves the encrypted session works). 4. NEG-CONTROLS (liar-kill -- the session MUST FAIL CLOSED if any security check is bypassed): a. EMPTY trust store -> cert validation FAILS -> no session b. tampered SKE signature -> SKE verify FAILS -> no session c. tampered server Finished -> Finished MAC FAILS -> no session expect_exit: 0 license_tier: ORIGINAL