-
Notifications
You must be signed in to change notification settings - Fork 228
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Now working when using tls client certificate auth #66
Comments
One more thing, when i use the nodejs client that i write instead of chrome, the tls connection can be established, its just that nothing will happen after that. |
Log from my caddy server:
|
By default, Caddy doesn't allow domain fronting when using client auth because of the obvious problem: clients could send a ServerName with the TLS handshake for an unprotected domain, then make HTTP requests with a Host header of a protected domain on that connection, thus bypassing authentication. Caddy 2 allows you to disable this protection. Caddy 1 might too but I can't remember how without looking. 😅 |
@mholt, I was looking for a way to disable Note: Caddy v1.0.4 |
Hmm, there's not in v1 I don't think, but we can do this pretty easily in v2! |
Gotcha... unfortunately v2 is still a no go for us since we rely entirely on DNS SRV for upstream discovery. Hence why I'm having the |
@danlsgiga We can change that, would your company be open to sponsoring that feature's development? I won't be working on v1 much anymore. |
1. Is bug reproducible with latest
forwardproxy
build?Yes
2. What are you trying to do?
using forwardproxy toghther with caddy's built-in TLS client certificate auth. the same configuration works fine without that
clients config/cert.pem
line. The exact same configuration works fine when not using proxy (i.e., just website hosting)3. What is your entire Caddyfile?
4. How is your client configured?
5. How did you run Caddy? (give the full command and describe the execution environment). If multiple servers are used (for example with
upstream
), describe those as well.just run it in the bash
6. Please paste any relevant HTTP request(s) here.
7. What did you expect to see?
The proxy working. Client certificate and https proxy works fine when I use the software I wrote using nodejs with chrome, meaning chrome supports such configuration. so the problem is on the server side.
8. What did you see instead (give full error messages and/or log)?
chrome gives me ERR_PROXY_CONNECTION_FAILED.
9. How can someone who is starting from scratch reproduce the bug as minimally as possible?
NOTE: in practice I don't use chrome directly with the proxy, but that doesn't matter since the error occur anyway.
The text was updated successfully, but these errors were encountered: