1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
global
maxconn 490
stats socket /tmp/sock1 mode 666 level admin
stats timeout 10m
ssl-server-verify none
tune.ssl.default-dh-param 1024
log /dev/log local0 debug info
defaults
mode http
log global
option httplog
option dontlognull
timeout connect 5s
timeout http-keep-alive 15s
timeout http-request 15s
timeout queue 30s
timeout tarpit 1m
timeout tunnel 300s
timeout client 30s
timeout server 60s
listen 1
bind :8001
# passes checks and traffic (no hostname check)
# server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem
# passes checks and traffic (localhost is what the server presents)
# server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem verifyhost localhost
# fails checks and traffic (foo not matched on the server)
# server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem verifyhost foo
# passes checks and traffic (verify none ignores the host)
# server ssl 127.0.0.1:8443 ssl verify none check inter 500 ca-file rsa2048.pem verifyhost foo
# passes checks and traffic (localhost is fine)
# server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem sni str(localhost) verifyhost localhost
# passes checks and traffic (verifyhost overrides sni)
# server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem sni str(foo) verifyhost localhost
# passes checks and traffic (localhost always valid)
# server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem sni str(localhost)
# passes checks, and traffic without host or with "host: localhost" and fails other hosts.
server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem sni req.hdr(host)
# just for tests
#server clear 127.0.0.1:8480
listen 2
bind :8480
bind :8443 ssl crt rsa2048.pem
stats uri /
|
