1. 17 Mar, 2018 2 commits
    • Toby Allen's avatar
    • Matt Holt's avatar
      tls: Fall back to certificate keyed by empty name (fixes #2035) (#2037) · 6e2de19d
      Matt Holt authored
      * tls: Fall back to certificate keyed by empty name (fixes #2035)
      
      This should only happen for sites defined with an empty hostname (like
      ":8080") and which are using self-signed certificates or some other
      funky self-managed certificate. But that certificate should arguably
      be used for all incoming SNI names.
      
      * tls: Revert to serving any certificate if no match, regardless of SNI
      
      Also fix self-signed certs to include IP addresses in their name
      if they are configured to serve an IP address
      
      * Remove tests which are now irrelevant (behavior reverted)
      
      It would be good to revisit this in the future.
      6e2de19d
  2. 15 Mar, 2018 1 commit
  3. 10 Mar, 2018 1 commit
  4. 21 Feb, 2018 2 commits
  5. 20 Feb, 2018 1 commit
  6. 18 Feb, 2018 2 commits
  7. 17 Feb, 2018 1 commit
  8. 16 Feb, 2018 4 commits
  9. 15 Feb, 2018 4 commits
  10. 14 Feb, 2018 1 commit
  11. 13 Feb, 2018 5 commits
  12. 11 Feb, 2018 2 commits
  13. 04 Feb, 2018 1 commit
    • Matthew Holt's avatar
      tls: Restructure and improve certificate management · fc2ff915
      Matthew Holt authored
      - Expose the list of Caddy instances through caddy.Instances()
      
      - Added arbitrary storage to caddy.Instance
      
      - The cache of loaded certificates is no longer global; now scoped
        per-instance, meaning upon reload (like SIGUSR1) the old cert cache
        will be discarded entirely, whereas before, aggressively reloading
        config that added and removed lots of sites would cause unnecessary
        build-up in the cache over time.
      
      - Key certificates in the cache by their SHA-256 hash instead of
        by their names. This means certificates will not be duplicated in
        memory (within each instance), making Caddy much more memory-efficient
        for large-scale deployments with thousands of sites sharing certs.
      
      - Perform name-to-certificate lookups scoped per caddytls.Config instead
        of a single global lookup. This prevents certificates from stepping on
        each other when they overlap in their names.
      
      - Do not allow TLS configurations keyed by the same hostname to be
        different; this now throws an error.
      
      - Updated relevant tests, with a stark awareness that more tests are
        needed.
      
      - Change the NewContext function signature to include an *Instance.
      
      - Strongly recommend (basically require) use of caddytls.NewConfig()
        to create a new *caddytls.Config, to ensure pointers to the instance
        certificate cache are initialized properly.
      
      - Update the TLS-SNI challenge solver (even though TLS-SNI is disabled
        currently on the CA side). Store temporary challenge cert in instance
        cache, but do so directly by the ACME challenge name, not the hash.
        Modified the getCertificate function to check the cache directly for
        a name match if one isn't found otherwise. This will allow any
        caddytls.Config to be able to help solve a TLS-SNI challenge, with one
        extra side-effect that might actually be kind of interesting (and
        useless): clients could send a certificate's hash as the SNI and
        Caddy would be able to serve that certificate for the handshake.
      
      - Do not attempt to match a "default" (random) certificate when SNI
        is present but unrecognized; return no certificate so a TLS alert
        happens instead.
      
      - Store an Instance in the list of instances even while the instance
        is still starting up (this allows access to the cert cache for
        performing renewals at startup, etc). Will be removed from list again
        if instance startup fails.
      
      - Laid groundwork for ACMEv2 and Let's Encrypt wildcard support.
      
      Server type plugins will need to be updated slightly to accommodate
      minor adjustments to their API (like passing in an Instance). This
      commit includes the changes for the HTTP server.
      
      Certain Caddyfile configurations might error out with this change, if
      they configured different TLS settings for the same hostname.
      
      This change trades some complexity for other complexity, but ultimately
      this new complexity is more correct and robust than earlier logic.
      
      Fixes #1991
      Fixes #1994
      Fixes #1303
      fc2ff915
  14. 03 Feb, 2018 5 commits
  15. 30 Jan, 2018 1 commit
  16. 27 Jan, 2018 1 commit
  17. 16 Jan, 2018 6 commits