use FQDN for servername (SNI) #4

New issue

Closed

opened 2021-09-10 11:53:48 +02:00 by heiko · 0 comments

heiko commented

2021-09-10 11:53:48 +02:00

Owner

It seems that there is at least one MITM proxy (Sophos) that tries to use the SNI as an indication where to forward the connection to. So we should use a FQDN SNI.

Currently we use "cert-proxy" as the default. This can easily be overwritten with the -servername <FQDN> option, but OTOH, the server needs to have a certificate that uses that FQDN.

the CA should provide a flag to include the FQDN in the SAN, or to use the FQDN as the CN, having a SAN of the FQDN and additional short names, if necessary.
the client should use the name from the connect URL as the SNI, except overridden by the -servername option

It seems that there is at least one MITM proxy (Sophos) that tries to use the SNI as an indication where to forward the connection to. So we should use a FQDN SNI. Currently we use "cert-proxy" as the default. This can easily be overwritten with the `-servername <FQDN>` option, but OTOH, the server needs to have a certificate that uses that FQDN. - [ ] the CA should provide a flag to include the FQDN in the SAN, or to use the FQDN as the CN, having a SAN of the FQDN and additional short names, if necessary. - [ ] the client should use the name from the connect URL as the SNI, except overridden by the `-servername` option