diff options
| author | Laurent Bercot <ska-skaware@skarnet.org> | 2021-11-18 17:46:43 +0000 |
|---|---|---|
| committer | Laurent Bercot <ska@appnovation.com> | 2021-11-18 17:46:43 +0000 |
| commit | 46e49260b35a2a39bbb92f44ceb598ab2db94d6a (patch) | |
| tree | eccdc2482d5c19c0d51d0d1d45f3070cdf9272ae /doc/s6-tlsd-io.html | |
| parent | 069e3184359c76f8bb4aa3e7c62a69d571b478ac (diff) | |
| download | s6-networking-46e49260b35a2a39bbb92f44ceb598ab2db94d6a.tar.xz | |
Allow SNI wildcarding for *.example.com
Signed-off-by: Laurent Bercot <ska@appnovation.com>
Diffstat (limited to 'doc/s6-tlsd-io.html')
| -rw-r--r-- | doc/s6-tlsd-io.html | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/doc/s6-tlsd-io.html b/doc/s6-tlsd-io.html index b2a4a1e..f21d487 100644 --- a/doc/s6-tlsd-io.html +++ b/doc/s6-tlsd-io.html @@ -129,6 +129,17 @@ entirely ignored. </p> <p> + You can wildcard the first level of a SNI domain: you can point +to a valid certificate for <tt><em>foo</em>.example.com</tt> for all +values of <em>foo</em> via a variable called <tt>CERTFILE:*.example.com</tt> +(and have the corresponding <tt>KEYFILE:*.example.com</tt>). Only the +first level can be wildcarded, and this does not work for top-level +domains (you cannot hold a certificate for <tt>*.com</tt>). Note: if you are +using a shell to handle your environment variables, be careful to +properly quote them so that it does not attempt to expand the asterisks. +</p> + +<p> If you are using client certificates, <tt>s6-tlsd-io</tt> also requires either one of the following variables to be set: </p> |