Could not look up a certificate for server name 'domain'

[newdev8]

I just installed sozu and setup my config as follows:

[[listeners]]
address = "0.0.0.0:443"
protocol = "https"
tls_versions = ["TLSv1.2", "TLSv1.3"]
cipher_list = "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"

[applications]

[applications.AppName]
protocol = "http"
https_redirect = true

frontends = [
  { address = "127.0.0.1:1444", hostname = "domain", certificate = "/etc/domain/cert.pem", key = "/etc/domain/key.pem", certificate_chain = "/etc/cloudflare/chain.pem" }
]

backends  = [
  { address = "127.0.0.1:444" }
]

But when I access my domain from the browser I get the following error:

could not look up a certificate for server name 'domain'
Sending fatal alert AccessDenied
could not perform handshake: General("no server certificate chain resolved")

[FlorentinDUBOIS]

Hello,

We have made some improvements to the certificate part on the branch 0.14. Could you test using this version ?

I will try to reproduce your issue on the main branch as well.

[newdev8]

Hey, after trying branch 0.14 I am still getting the same error. Maybe it's me doing something wrong. I am running an actix server on port 444 with the same SSL certificate/key as the one used in my sozu configuration file.

[FlorentinDUBOIS]

Thank you! Sounds interesting, I will take a look at it.

[PlainBane]

Hello, I'm having the same issue. I'm using letsencrypt certificate. Config is the standard thing from examples. At first tls would not work at all, but now sozu handles encryption for one domain. Main or subdomain, but not both. If I change https_redirect in the .toml config for cluster and restart sozu, it switches. Build: custom from the 'main' branch. TLSv1.3 only | Linux Mint 21| rustc 1.64.0.

[PlainBane]

Hello, The issue is lib/src/router/trie.rs ~162 pub fn lookup(&self, partial_key: &[u8], accept_wildcard: bool) The domain lookup by key fails sometimes. It doesn't seem to handle subdomains correctly. It depends on what it has on domains list and what key it is looking for. I can't test it with domain wildcards, so can't fix it. I made a quick and dirty work-around in my code an it works fine.