netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

www/caddy: Replace tls_trusted_ca_certs with tls_trust_pool file, since the former has been deprecated. (#4070)

Browse Source
This commit is contained in:
Monviech
2024-07-03 14:15:42 +02:00
committed by GitHub
parent 71dd1a69da
commit 96170a0b2e
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml
+2 -2
View File
@@ -123,7 +123,7 @@
</field>
<field>
<id>handle.HttpTlsTrustedCaCerts</id>
<label>TLS Trusted CA Certificate</label>
<label>TLS Trust Pool</label>
<type>dropdown</type>
<help><![CDATA[Choose a CA or self-signed certificate to trust from "System - Trust - Authorities". Useful if the upstream destination only accepts TLS connections and offers a self signed certificate. Adding that certificate here will allow for the encrypted connection to succeed.]]></help>
</field>
@@ -131,6 +131,6 @@
<id>handle.HttpTlsServerName</id>
<label>TLS Server Name</label>
<type>text</type>
<help><![CDATA[Enter a hostname or IP address that matches the SAN "Subject Alternative Name" of the offered upstream certificate. This will change the SNI "Server Name Indication" of Caddy. Setting an IP address as "Upstream Domain", enabling "TLS" and selecting a "TLS Trusted CA Certificate", would make the SAN of the offered upstream certificate not match with the SNI of Caddy, since it will be an IP address instead of a hostname. Setting the hostname of the certificate here, fixes this issue. Please note that only SAN certificates are supported; CN "Common Name" will not work.]]></help>
<help><![CDATA[Enter a hostname or IP address that matches the SAN "Subject Alternative Name" of the offered upstream certificate. This will change the SNI "Server Name Indication" of Caddy. Setting an IP address as "Upstream Domain", enabling "TLS" and selecting a "TLS Trust Pool", would make the SAN of the offered upstream certificate not match with the SNI of Caddy, since it will be an IP address instead of a hostname. Setting the hostname of the certificate here, fixes this issue. Please note that only SAN certificates are supported; CN "Common Name" will not work.]]></help>
</field>
</form>
www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+2 -2
View File
@@ -383,7 +383,7 @@
tls_insecure_skip_verify
{% endif %}
{% if handle.HttpTlsTrustedCaCerts %}
tls_trusted_ca_certs /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
tls_trust_pool file /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
{% endif %}
{% if handle.HttpTlsServerName %}
tls_server_name {{ handle.HttpTlsServerName }}
@@ -398,7 +398,7 @@
tls_insecure_skip_verify
{% endif %}
{% if handle.HttpTlsTrustedCaCerts %}
tls_trusted_ca_certs /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
tls_trust_pool file /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
{% endif %}
{% if handle.HttpTlsServerName %}
tls_server_name {{ handle.HttpTlsServerName }}