Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

reverseproxy: add tls_server_cert_sha256 #6329

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

akovalenko
Copy link
Contributor

Unfortunately there are some production setups requiring tls_insecure_skip_verify in reverse_proxy, like old devices with outdated firmware. In many such cases, the devices aren't supposed to regenerate or update their certificates.

This patch adds tls_server_cert_sha256 directive for reverse_proxy, making MITM impossible even with tls_insecure_skip_verify.

@CLAassistant
Copy link

CLAassistant commented May 20, 2024

CLA assistant check
All committers have signed the CLA.

Unfortunately there *are* some production setups requiring
tls_insecure_skip_verify in reverse_proxy, like old devices with
outdated firmware. In many such cases, the devices aren't supposed to
regenerate or update their certificates.

This patch adds tls_server_cert_sha256 directive for reverse_proxy,
making MITM impossible even with tls_insecure_skip_verify.
@akovalenko akovalenko force-pushed the master branch 2 times, most recently from 408709b to 5fde819 Compare May 25, 2024 15:54
@mholt mholt modified the milestones: v2.9.0-beta.1, v2.9.0-beta.2 Oct 2, 2024
Copy link
Member

@mholt mholt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks; is this a use case you've encountered? Could you elaborate?

I ask because while I appreciate that it tries to make something insecure secure, it also effectively pins keys which is... not secure. 🙃

// If non-empty, TLS compares the SHA-256 fingerprint of the
// server certificate to a fixed value, specified as
// hexadecimal string.
ServerCertSha256 string `json:"server_cert_sha256,omitempty"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
ServerCertSha256 string `json:"server_cert_sha256,omitempty"`
ServerCertSHA256 string `json:"server_cert_sha256,omitempty"`

@steffenbusch
Copy link
Contributor

I have a similar use case where I reverse-proxy to a Podman container with a self-signed certificate that has a very long lifetime.
To avoid using tls_insecure_skip_verify, I use the tls_trust_pool file /path/to/localhost_127_0_0_1.pem directive instead, which also prevents MITM by leveraging existing functionality.
You can find more details here: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#tls_trust_pool

@mholt mholt modified the milestones: v2.9.0-beta.3, v2.9.0-beta.4 Nov 5, 2024
@mholt
Copy link
Member

mholt commented Nov 14, 2024

@steffenbusch That's probably the preferred thing to do. @akovalenko does that work for you?

@mholt mholt modified the milestones: v2.9.0-beta.4, v2.10.0-beta.1 Dec 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature ⚙️ New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants