No certificate matching TLS ClientHello

plorenzo · November 27, 2023, 1:47am

You are right, without the email option it works again.

I thought we fixed that in the past

github.com/caddyserver/caddy

Certificate for Tailscale domain is not found if email option is set in Caddyfile

opened 01:51AM - 10 May 22 UTC

closed 09:13PM - 01 Jun 22 UTC

Plorenzo

bug

Full context on the forum: [No matching certificate for Tailscale domain](https:…//caddy.community/t/no-matching-certificate-for-tailscale-domain/15904) If you add the `email` global directive to a Caddyfile that has a Tailscale domain, a certificate not found error is triggered. ``` May 08 06:51:15 azabache caddy[259395]: {"level":"debug","ts":1651992675.3014572,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"azabache.narwhal-nominal.ts.net"} ``` Working Caddyfile: ``` { debug servers { protocol { experimental_http3 } } } azabache.narwhal-nominal.ts.net { encode zstd gzip rewrite * /admin{uri} reverse_proxy localhost:1080 log { output file /var/log/caddy/pihole.log } } ``` Faulty Caddyfile: ``` { debug email plorenzo@hey.com servers { protocol { experimental_http3 } } } azabache.narwhal-nominal.ts.net { encode zstd gzip rewrite * /admin{uri} reverse_proxy localhost:1080 log { output file /var/log/caddy/pihole.log } } ``` adding the `tls` directive in the server block fixes the issue: ``` { debug email plorenzo@hey.com servers { protocol { experimental_http3 } } } azabache.narwhal-nominal.ts.net { encode zstd gzip tls { get_certificate tailscale } rewrite * /admin{uri} reverse_proxy localhost:1080 log { output file /var/log/caddy/pihole.log } } ```

Should I open a new issue?