SPDX-License-Identifier: AGPL-3.0-only

Avoid relying on Default for certificate validation errors with newer deps.

Keep TLS shutdown interruptible.  tls-2.4's bye waits for a bounded TLS 1.3
final flight using System.Timeout; wrapping it in uninterruptibleMask_ prevents
that timeout from being delivered and can leave test and runtime shutdown
blocked forever when the peer has already gone away.  mask_ still protects the
socket cleanup while allowing interruptible TLS I/O (and bye's timeout) to
finish the bracket.

Index: src/Simplex/Messaging/Transport/Client.hs
--- src/Simplex/Messaging/Transport/Client.hs.orig
+++ src/Simplex/Messaging/Transport/Client.hs
@@ -183,7 +183,7 @@ runTLSTransportClient tlsParams caStore_
     sent <- readIORef clientCredsSent
     client =<< set CHTransport (getTransportConnection tCfg sent chain tls)
   where
-    closeConn = readIORef >=> mapM_ (\c -> E.uninterruptibleMask_ $ closeConn_ c `catchAll_` pure ())
+    closeConn = readIORef >=> mapM_ (\c -> E.mask_ $ closeConn_ c `catchAll_` pure ())
     closeConn_ = \case
       CHSocket sock -> close sock
       CHContext tls -> closeTLS tls
@@ -301,7 +301,7 @@ mkTLSClientParams supported caStore_ hos
   where
     p = B.pack port
     onServerCert _ _ _ cc = do
-      errs <- maybe def (\ca -> validateCertificateChain ca host p cc) cafp_
+      errs <- maybe (pure []) (\ca -> validateCertificateChain ca host p cc) cafp_
       atomically $ putTMVar serverCerts $ if null errs then Just cc else Nothing
       pure errs
     onCertRequest = case clientCreds_ of
