summaryrefslogtreecommitdiff
path: root/doc/s6-tlsd-io.html
diff options
context:
space:
mode:
authorLaurent Bercot <ska-skaware@skarnet.org>2021-11-18 17:46:43 +0000
committerLaurent Bercot <ska@appnovation.com>2021-11-18 17:46:43 +0000
commit46e49260b35a2a39bbb92f44ceb598ab2db94d6a (patch)
treeeccdc2482d5c19c0d51d0d1d45f3070cdf9272ae /doc/s6-tlsd-io.html
parent069e3184359c76f8bb4aa3e7c62a69d571b478ac (diff)
downloads6-networking-46e49260b35a2a39bbb92f44ceb598ab2db94d6a.tar.xz
Allow SNI wildcarding for *.example.com
Signed-off-by: Laurent Bercot <ska@appnovation.com>
Diffstat (limited to 'doc/s6-tlsd-io.html')
-rw-r--r--doc/s6-tlsd-io.html11
1 files changed, 11 insertions, 0 deletions
diff --git a/doc/s6-tlsd-io.html b/doc/s6-tlsd-io.html
index b2a4a1e..f21d487 100644
--- a/doc/s6-tlsd-io.html
+++ b/doc/s6-tlsd-io.html
@@ -129,6 +129,17 @@ entirely ignored.
</p>
<p>
+ You can wildcard the first level of a SNI domain: you can point
+to a valid certificate for <tt><em>foo</em>.example.com</tt> for all
+values of <em>foo</em> via a variable called <tt>CERTFILE:*.example.com</tt>
+(and have the corresponding <tt>KEYFILE:*.example.com</tt>). Only the
+first level can be wildcarded, and this does not work for top-level
+domains (you cannot hold a certificate for <tt>*.com</tt>). Note: if you are
+using a shell to handle your environment variables, be careful to
+properly quote them so that it does not attempt to expand the asterisks.
+</p>
+
+<p>
If you are using client certificates, <tt>s6-tlsd-io</tt>
also requires either one of the following variables to be set:
</p>