4 ms·
Is there anything that would prevent an attack involving bogus SNI requests in order to trigger a DOS?
by d33 10y ago
Is there anything that would prevent an attack involving bogus SNI requests in order to trigger a DOS?
- nickblah 10y agoYes, by default the module requires that you explicitly whitelist the domains you want to allow certificate registration for. So while you could allow any domain to be registered, that's not recommended for this precise reason. But the whitelist is defined as a Lua function, so you have quite a bit of flexibility in integrating the whitelist logic with other sources of information. See https://github.com/GUI/lua-resty-auto-ssl#precautions https://github.com/GUI/lua-resty-auto-ssl#precautions and the "allowed_domain" configuration for a bit more detail.