3 ms·
The solution to this is TLS SNI redirecting. You can front a TLS server on port 443 and then redirect without decrypting the connection based on the SNI name t
by XorNot 7mo ago
The solution to this is TLS SNI redirecting.
You can front a TLS server on port 443 and then redirect without decrypting the connection based on the SNI name to your final destination host.
- J-Kuhn 7mo agoBut... this doesn't work for SSH, which is the problem here?
- XorNot 7mo agoSSH has ProxyCommand which accepts the %h template. Provided your users will configure something a little - or you provide a wrapping command - you can setup the tunneling for them.
- devnotes77 7mo ago[dead]
- miladyincontrol 7mo agoIm not saying its the solution I would implement but caddy's L4 module does let you do this, essentially using TLS as a tunnel and openssl in the proxy command to terminate it client side.