crypto/tls: allow choosing ClientAuth (and others?) based on SNI #15707
Labels
FeatureRequest
FrozenDueToAge
NeedsFix
The path to resolution is known, but the work has not been done.
Milestone
Comments
|
Probably related to #15699. |
|
The ability to do this in a Go application would be great for internet facing services. Currently it's relatively easy to support Let's Encrypt, but this limitation requires us to go back to using HAProxy. My application bundles a SCEP server to issue client certificates and then requires the client to provide the cert at another SNI. Currently it's impossible to do both in a single Go server without using two separate ports. |
|
I hope to spend a week working on Go in the 1.8 cycle and to address this. |
|
Noticed title prefix of this issue has a typo: crpyto -> crypto |
bradfitz
changed the title
|
See #16066 for a related issue and my comment #16066 (comment) for one idea. |
quentinmit
added
the
NeedsFix
|
CL https://golang.org/cl/30790 mentions this issue. |
FiloSottile
pushed a commit
to FiloSottile/go
that referenced
this issue
Oct 12, 2018
GetConfigForClient allows the tls.Config to be updated on a per-client basis. Fixes golang#16066. Fixes golang#15707. Fixes golang#15699. Change-Id: I2c675a443d557f969441226729f98502b38901ea Reviewed-on: https://go-review.googlesource.com/30790 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
FiloSottile
pushed a commit
to FiloSottile/go
that referenced
this issue
Oct 12, 2018
GetConfigForClient allows the tls.Config to be updated on a per-client basis. Fixes golang#16066. Fixes golang#15707. Fixes golang#15699. Change-Id: I2c675a443d557f969441226729f98502b38901ea Reviewed-on: https://go-review.googlesource.com/30790 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
tls.Config.ClientAuthis global per server, however there's no reason it shouldn't be a func(clientHello *ClientHelloInfo) (ClientAuthType, *x509.CertPool). See example use case in caddyserver/caddy#829.On the other hand, the same can be said about NextProtos (already a desired feature, to have HTTP/2 enabled only on some hosts, caddyserver/caddy#189), CipherSuites, SessionTicketKey, ClientSessionCache, CurvePreferences...
I suspect some of them have issues open about them already, but couldn't find them.
The text was updated successfully, but these errors were encountered: