3 ms·

OCSP stapling isn't supported yet by Go as far as I can tell, but I'll implement PROXY for HTTP proxying (not for TCP proxying of course)... And yes, it's usin

OCSP stapling isn't supported yet by Go as far as I can tell, but I'll implement PROXY for HTTP proxying (not for TCP proxying of course)... And yes, it's using SNI which is now largely supported, but I think I can add an option to restrict it to as single TLS certificate (and make it work without SNI). The original use-case is a friend with 2500 websites hosted on a single server, and he wants to make the switch to TLS ;-) but I'll try to make it work for everyone!

stephenr 9y ago
I see. Re: SNI I meant the ACME challenge mode to issue the LE cert: given that it only listens on :443 i assumed it must use the tls-sni based challenge, rather than the http based challenge?
- weddpros 9y ago
  By proxy, do you mean https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt ? this looks very new... (I thought you were talking about X-Forwarded-For) Yes, it's using the TLS-SNI challenge (through golang's autocert)
  - stephenr 9y ago
    Yes that's what I meant by PROXY protocol support. Introduced 7 years ago is "very new"?
    - weddpros 9y ago
      I must have read a bit too fast... I'd never heard of it actually, I just knew about X-Forwarded-For for HTTP but I didn't know of a TCP compatible protocol. I've read the RFC, it's easy enough to implement the v1, I'll do it... If you're willing to test it with me, please email me chris [à] chris-hartwig.com
    - weddpros 9y ago
      done... https://tlsproxy.com/new-proxy-support/ https://tlsproxy.com/new-proxy-support/ Please tell me how it works for you if you try it!