caddy

caddy copied to clipboard

Unfortunately there are some production setups requiring tls_insecure_skip_verify in reverse_proxy, like old devices with outdated firmware. In many such cases, the devices aren't supposed to regenerate or update their certificates.

This patch adds tls_server_cert_sha256 directive for reverse_proxy, making MITM impossible even with tls_insecure_skip_verify.

All committers have signed the CLA.

I have a similar use case where I reverse-proxy to a Podman container with a self-signed certificate that has a very long lifetime.
To avoid using tls_insecure_skip_verify, I use the tls_trust_pool file /path/to/localhost_127_0_0_1.pem directive instead, which also prevents MITM by leveraging existing functionality.
You can find more details here: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#tls_trust_pool

@steffenbusch That's probably the preferred thing to do. @akovalenko does that work for you?

I've been thinking on this and sitting on this and I don't love that it pins specific keys (which is discouraged), and it sounds like there are other mechanisms that work for people... @akovalenko I might close this, respectfully; but feel free to continue discussion and we can reopen this if necessary.