Hello everyone, I wanted to use caddy as a reverse proxy for my services. When I reverseproxy to the unencrypted http:// variant of the services, it seems fine. However I want to use the encrypted https:// variants also “behind” the proxy. But, when I do that i get the following errors in the log…

Ok answering my question: You can use the tls_insecure_skip_verify option as stated in the Docs . Weird that it is under http and not https. Also … Reverse proxy to an HTTPS upstream, but ⚠️ disable TLS verification. this is NOT RECOMMENDED, since it disables all security checks that HTTPS offers…

[image] Raider: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead This means the certificate presented by the backend only has a CommonName field, but this has been deprecated for about 20 years and Go no longer supports it. The backend …

[image] matt: but this has been deprecated for about 20 years The NextCloud container from linuxserver.io uses such certificate apparently. lol. [image] matt: To make a secure connection to an IP address, you need an IP certificate, meaning a cert with an IP address instead of a domain n…

[image] Raider: Wouldn’t even be possible for private IPs, would it? Yeah, you can issue your own IP cert just like any other cert. The problem is that if you’re issuing it yourself, you have to install the (root) cert into trust stores of clients like Caddy. [image] Raider: I do trust t…

[image] Raider: You can use the tls_insecure_skip_verify option as stated in the Docs . Weird that it is under http and not https. The http there is the module name for the transport. The http module handles both HTTP and HTTPS traffic. Other transports include fastcgi which is a totally diff…

Caddy Community

Certificate relies on legacy Common Name field, use SANs instead

Help

show post in topic

Home
Categories
Guidelines
Terms of Service

Powered by Discourse, best viewed with JavaScript enabled