mTLS: tls internal error

[basil (Basil Hendroff)]

@francislavoie Over the month of July, since moving away from this structure…

    reverse_proxy @mtls {backend} {
      header_up Host {http.reverse_proxy.upstream.hostport}
      header_up X-Forwarded-Host {host}
      transport http {
        tls
      }
    }

…to this structure…

(proxy-mtls) {
  @{args.0} host {args.0}.udance.com.au
  reverse_proxy @{args.0} https://{args.1} {
    header_up Host {http.reverse_proxy.upstream.hostport}
    header_up X-Forwarded-Host {host}
  }
}

mTLS has been rock solid. Not relying on a fix, but I’ll leave you with the observation that mTLS is unreliable under the former structure.

[francislavoie]

Strange. Well the main difference is that in the former, the upstream is dynamic, and in the latter, it’s known upfront. I’ll need to follow up and read the code to see if I can glean anything from that regarding mTLS. I’m afk for the weekend.