7b33c8db31 
								
									
								
							
								 
							
						 
						
							
							
								
								tls: Make cert and OCSP check intervals configurable  
							
							
 
							
							
							This enables use of ACME CAs that issue shorter-lived certs 
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								11696793bd 
								
									
								
							
								 
							
						 
						
							
							
								
								tls/acme: Ability to customize trusted roots for ACME servers ( #2756 )  
							
							
 
							
							
							Closes  #2702  
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								19f36667f7 
								
									
								
							
								 
							
						 
						
							
							
								
								tls: Clean up expired OCSP staples and certificates  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								f15f0d5839 
								
									
								
							
								 
							
						 
						
							
							
								
								Eliminate some TODOs  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								839507e24e 
								
									
								
							
								 
							
						 
						
							
							
								
								http: Consider wildcards when evaluating automatic HTTPS  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								ed40a5dcab 
								
									
								
							
								 
							
						 
						
							
							
								
								tls: Do away with SetDefaults which did nothing useful  
							
							
 
							
							
							CertMagic uses the same defaults for us 
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								7799554baa 
								
									
								
							
								 
							
						 
						
							
							
								
								go.mod: Use lego v3 and CertMagic 0.7.0  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								2cb01d43cf 
								
									
								
							
								 
							
						 
						
							
							
								
								tls: Remove support for TLS 1.0 and TLS 1.1  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								b4dce74e59 
								
									
								
							
								 
							
						 
						
							
							
								
								tls: Use Let's Encrypt production endpoint  
							
							
 
							
							
							We're done testing this in staging 
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								1ce10b453f 
								
									
								
							
								 
							
						 
						
							
							
								
								Require Go 1.13; use Go 1.13's default support for TLS 1.3  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								50961ecc77 
								
							
								 
							
						 
						
							
							
								
								Initial implementation of TLS client authentication ( #2731 )  
							
							
 
							
							
							* Add support for client TLS authentication
Signed-off-by: Alexandre Stein <alexandre_stein@interlab-net.com>
* make and use client authentication struct
* force StrictSNIHost if TLSConnPolicies is not empty
* Implement leafs verification
* Fixes issue when using multiple verification
* applies the comments from maintainers
* Apply comment
* Refactor/cleanup initial TLS client auth implementation 
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								c9980fd367 
								
									
								
							
								 
							
						 
						
							
							
								
								Refactor Caddyfile adapter and module registration  
							
							
 
							
							
							Use piles from which to draw config values.
Module values can return their name, so now we can do two-way mapping
from value to name and name to value; whereas before we could only map
name to value. This was problematic with the Caddyfile adapter since
it receives values and needs to know the name to put in the config. 
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								ab885f07b8 
								
									
								
							
								 
							
						 
						
							
							
								
								Implement config adapters and beginning of Caddyfile adapter  
							
							
 
							
							
							Along with several other changes, such as renaming caddyhttp.ServerRoute
to caddyhttp.Route, exporting some types that were not exported before,
and tweaking the caddytls TLS values to be more consistent.
Notably, we also now disable automatic cert management for names which
already have a cert (manually) loaded into the cache. These names no
longer need to be specified in the "skip_certificates" field of the
automatic HTTPS config, because they will be skipped automatically. 
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								28df6cedfe 
								
									
								
							
								 
							
						 
						
							
							
								
								tls: Use IANA-standard cipher suite names  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								dd6aa91d72 
								
									
								
							
								 
							
						 
						
							
							
								
								Fix DNS provider module unmarshaling ( closes   #2676 )  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								79216d356c 
								
									
								
							
								 
							
						 
						
							
							
								
								acmemanager: Use storage module key "module" instead of "system"  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
								
								
							
							
								
							
								fdd871e177 
								
									
								
							
								 
							
						 
						
							
							
								
								go.mod: Append /v2 to module name; update all import paths  
							
							
 
							
							
							See https://github.com/golang/go/wiki/Modules#semantic-import-versioning  
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								533d1afb4b 
								
							
								 
							
						 
						
							
							
								
								tls: Enable TLS 1.3 by default; set sane defaults on tls.Config structs  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								3177ee8010 
								
							
								 
							
						 
						
							
							
								
								Add license  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								2b22d2e6ea 
								
							
								 
							
						 
						
							
							
								
								Optionally enforce strict TLS SNI + HTTP Host matching, & misc. cleanup  
							
							
 
							
							
							We should look into a way to enable this by default when TLS client auth
is configured for a server 
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								38677aaa58 
								
							
								 
							
						 
						
							
							
								
								caddytls: Support tags for manually-loaded certificates  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								81a9e125b5 
								
							
								 
							
						 
						
							
							
								
								Oops  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								269b1e9aa3 
								
							
								 
							
						 
						
							
							
								
								tls: Improve (and fix) on-demand configuration  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								6706c9225a 
								
							
								 
							
						 
						
							
							
								
								Implement templates handler; various minor cleanups and bug fixes  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								5137859e47 
								
							
								 
							
						 
						
							
							
								
								Rename caddy2 -> caddy  
							
							
 
							
							
							Removes the version from the package name 
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								b79f86f256 
								
							
								 
							
						 
						
							
							
								
								Fix bugs related to auto HTTPS and alternate port configurations  
							
							
								
 
							
							
						 
						6 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								613aecb898 
								
							
								 
							
						 
						
							
							
								
								Change import paths to GitHub package names  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								f064889a4f 
								
							
								 
							
						 
						
							
							
								
								Customize admin endpoint address with -listen flag  
							
							
 
							
							
							This is a temporary holdover for development purposes 
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								3439933235 
								
							
								 
							
						 
						
							
							
								
								Implement session ticket keys; default STEK module with rotation  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								da6a8cfc86 
								
							
								 
							
						 
						
							
							
								
								Minor cleanups  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								9cd6f35e9d 
								
							
								 
							
						 
						
							
							
								
								Separate out certificate selection  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								210d0cf7f1 
								
							
								 
							
						 
						
							
							
								
								Implement custom cert selection policies; optimize matching for SNI  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								be9b6e7b57 
								
							
								 
							
						 
						
							
							
								
								Honor the configured CA value  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								2fd98cb040 
								
							
								 
							
						 
						
							
							
								
								Module.New() does not need to return an error  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								1f0c061ce3 
								
							
								 
							
						 
						
							
							
								
								Architectural shift to using context for config and module state  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								f9d93ead4e 
								
							
								 
							
						 
						
							
							
								
								Rename and export some types, other minor changes  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								48b5a80320 
								
							
								 
							
						 
						
							
							
								
								Remove (unimplemented) enterprise TLS matchers  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								5859cd8dad 
								
							
								 
							
						 
						
							
							
								
								Instantiate apps that are needed but not explicitly configured  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								43961b542b 
								
							
								 
							
						 
						
							
							
								
								General cleanup and more godocs  
							
							
								
 
							
							
						 
						7 years ago  
				
					
						
							
							
								 
						
							
							
							
								
							
								2d056fbe66 
								
							
								 
							
						 
						
							
							
								
								Initial commit of Storage, TLS, and automatic HTTPS implementations  
							
							
								
 
							
							
						 
						7 years ago