3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-04-28 18:06:34 +02:00
Code Issues Projects Releases Packages Wiki Activity

tls: wildcard catch-all cert must be at the end of cert list (#4119)

Browse source
This commit is contained in:
Denis Mishin 2023-04-21 12:37:32 -04:00 • committed by GitHub
parent 681cf6fa27
commit 34c1e44c7e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.gitignore vendored
View file

@ -3,6 +3,7 @@
.*.yaml
.*.json
.*.rego
*.jq
pem
env
coverage.txt

4
config/envoyconfig/listeners.go
View file

@ -114,9 +114,7 @@ func getAllCertificates(cfg *config.Config) ([]tls.Certificate, error) {
return nil, fmt.Errorf("error getting wildcard certificate: %w", err)
}
// wildcard certificate must be first so that it is used as the default certificate
// when no SNI matches
return append([]tls.Certificate{*wc}, allCertificates...), nil
return append(allCertificates, *wc), nil
}
func (b *Builder) buildTLSSocket(ctx context.Context, cfg *config.Config, certs []tls.Certificate) (*envoy_config_core_v3.TransportSocket, error) {