mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2025-09-22 06:11:32 +02:00
94bd319b26
In bug #810, the SNI are not matched correctly, indeed when trying to match a certificate type in ssl_sock_switchctx_cbk() all SNIs were not looked up correctly. In the case you have in a crt-list: wildcard.subdomain.domain.tld.pem.rsa *.subdomain.domain.tld record.subdomain.domain.tld record.subdomain.domain.tld.pem.ecdsa record.subdomain.domain.tld another-record.subdomain.domain.tld If the client only supports RSA and requests "another-record.subdomain.domain.tld", HAProxy will find the single ECDSA certificate and won't try to look up for a wildcard RSA certificate. This patch fixes the code so we look for all single and wildcard before chosing the certificate type. This bug was introduced by commit 3777e3a ("BUG/MINOR: ssl: certificate choice can be unexpected with openssl >= 1.1.1"). It must be backported as far as 1.8 once it is heavily tested.
The HAProxy documentation has been split into a number of different files for ease of use. Please refer to the following files depending on what you're looking for : - INSTALL for instructions on how to build and install HAProxy - BRANCHES to understand the project's life cycle and what version to use - LICENSE for the project's license - CONTRIBUTING for the process to follow to submit contributions The more detailed documentation is located into the doc/ directory : - doc/intro.txt for a quick introduction on HAProxy - doc/configuration.txt for the configuration's reference manual - doc/lua.txt for the Lua's reference manual - doc/SPOE.txt for how to use the SPOE engine - doc/network-namespaces.txt for how to use network namespaces under Linux - doc/management.txt for the management guide - doc/regression-testing.txt for how to use the regression testing suite - doc/peers.txt for the peers protocol reference - doc/coding-style.txt for how to adopt HAProxy's coding style - doc/internals for developer-specific documentation (not all up to date)