3 ms·

forward secrecy: fixed cipher order weak ciphers: 3DES is not weak only a bit less strong, fixed anyway I'm still working on making TLSproxy better. A little

forward secrecy: fixed cipher order weak ciphers: 3DES is not weak only a bit less strong, fixed anyway I'm still working on making TLSproxy better. A little encouragement will help ;-) Now 'A' with SSLLabs, with 0 configuration, which is WAY better than the vast majority of TLS servers out there (people don't take the time).

stephenr 9y ago
Great work. Any chance of supporting ocsp stapling and PROXY protocol? Presumably it uses the tls-sni challenge for LE certs?
- weddpros 9y ago
  OCSP stapling isn't supported yet by Go as far as I can tell, but I'll implement PROXY for HTTP proxying (not for TCP proxying of course)... And yes, it's using SNI which is now largely supported, but I think I can add an option to restrict it to as single TLS certificate (and make it work without SNI). The original use-case is a friend with 2500 websites hosted on a single server, and he wants to make the switch to TLS ;-) but I'll try to make it work for everyone!
  - stephenr 9y ago
    I see. Re: SNI I meant the ACME challenge mode to issue the LE cert: given that it only listens on :443 i assumed it must use the tls-sni based challenge, rather than the http based challenge?
    - weddpros 9y ago
      By proxy, do you mean https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt ? this looks very new... (I thought you were talking about X-Forwarded-For) Yes, it's using the TLS-SNI challenge (through golang's autocert)
      - stephenr 9y ago
        Yes that's what I meant by PROXY protocol support. Introduced 7 years ago is "very new"?
        weddpros 9y ago
        I must have read a bit too fast... I'd never heard of it actually, I just knew about X-Forwarded-For for HTTP but I didn't know of a TCP compatible protocol. I've read the RFC, it's easy enough to implement the v1, I'll do it... If you're willing to test it with me, please email me chris [à] chris-hartwig.com
        weddpros 9y ago
        done... https://tlsproxy.com/new-proxy-support/ https://tlsproxy.com/new-proxy-support/ Please tell me how it works for you if you try it!

stephenr 9y ago

Great work. Any chance of supporting ocsp stapling and PROXY protocol? Presumably it uses the tls-sni challenge for LE certs?

weddpros 9y ago
OCSP stapling isn't supported yet by Go as far as I can tell, but I'll implement PROXY for HTTP proxying (not for TCP proxying of course)... And yes, it's using SNI which is now largely supported, but I think I can add an option to restrict it to as single TLS certificate (and make it work without SNI). The original use-case is a friend with 2500 websites hosted on a single server, and he wants to make the switch to TLS ;-) but I'll try to make it work for everyone!
- stephenr 9y ago
  I see. Re: SNI I meant the ACME challenge mode to issue the LE cert: given that it only listens on :443 i assumed it must use the tls-sni based challenge, rather than the http based challenge?
  - weddpros 9y ago
    By proxy, do you mean https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt ? this looks very new... (I thought you were talking about X-Forwarded-For) Yes, it's using the TLS-SNI challenge (through golang's autocert)
    - stephenr 9y ago
      Yes that's what I meant by PROXY protocol support. Introduced 7 years ago is "very new"?
      - weddpros 9y ago
        I must have read a bit too fast... I'd never heard of it actually, I just knew about X-Forwarded-For for HTTP but I didn't know of a TCP compatible protocol. I've read the RFC, it's easy enough to implement the v1, I'll do it... If you're willing to test it with me, please email me chris [à] chris-hartwig.com
      - weddpros 9y ago
        done... https://tlsproxy.com/new-proxy-support/ https://tlsproxy.com/new-proxy-support/ Please tell me how it works for you if you try it!