6 Commits

Author	SHA1	Message	Date
Brad Fitzpatrick	7cf8ec8108	net/tlsdial: bake in LetsEncrypt's ISRG Root X1 root ... We still try the host's x509 roots first, but if that fails (like if the host is old), we fall back to using LetsEncrypt's root and retrying with that. tlsdial was used in the three main places: logs, control, DERP. But it was missing in dnsfallback. So added it there too, so we can run fine now on a machine with no DNS config and no root CAs configured. Also, move SSLKEYLOGFILE support out of DERP. tlsdial is the logical place for that support. Fixes #1609 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2021-10-01 08:30:07 -07:00
Brad Fitzpatrick	cf0d19f0ab	net/tlsdial, derp/derphttp: finish DERPNode.CertName validation	2020-06-01 09:01:37 -07:00
Brad Fitzpatrick	2244cca5ff	net/tlsdial: update package doc to say it's now somewhat useless	2020-04-27 08:17:18 -07:00
Brad Fitzpatrick	172d72a060	Revert "net/tlsdial: add memory-optimized TLS cert verification path for iOS" ... This reverts commit 6fcbd4c4d476bd461c9bd2e52df6e3b7964a6452. Decided to put it in tailscale/go's crypto/x509 instead.	2020-04-27 08:13:37 -07:00
Brad Fitzpatrick	6fcbd4c4d4	net/tlsdial: add memory-optimized TLS cert verification path for iOS ... Behind a build tag for now.	2020-04-25 13:55:51 -07:00
Brad Fitzpatrick	b6fa5a69be	net/tlsdial: add package for TLS dials, and make DERP & controlclient use it ... This will do the iOS-optimized cert checking in a following change.	2020-04-25 13:24:53 -07:00