validate clienthello
Kim committed
Mar 4, 2026 at 12:34 UTC
b0964ec9f0dde355bb5c79ffa667e06d965e87f4
1 file changed
+5
cmd/relay-server/serve.go
+5
@@ -127,8 +127,13 @@ func serveAPI(addr string, serv *portal.RelayServer, admin *Admin, frontend *Fro
127
TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler)),
128
}
129
acmeManager := serv.GetACMEManager()
130
+ rootHost := types.PortalRootHost(flagPortalURL)
131
srv.TLSConfig = &tls.Config{
132
GetCertificate: func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
133
+ serverName := strings.TrimSpace(strings.ToLower(hello.ServerName))
134
+ if serverName != "" && !strings.EqualFold(serverName, rootHost) {
135
+ return nil, fmt.Errorf("acme certificate is only served for portal root host %q", rootHost)
136
+ }
137
certFile, keyFile := acmeManager.TLSFiles()
138
cert, err := tls.LoadX509KeyPair(certFile, keyFile)
139
if err != nil {