Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

2020-06-02 Thread Maxim Dounin
Hello! On Tue, Jun 02, 2020 at 01:01:18PM -0700, PGNet Dev wrote: > On 6/2/20 12:34 PM, Maxim Dounin wrote: > > The mis-match comes from trying to redefine the name in some parts > > of the configuration but not others. Hope the above explanation > > helps. > > I've reread your comment > >

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

2020-06-02 Thread PGNet Dev
On 6/2/20 12:34 PM, Maxim Dounin wrote: > The mis-match comes from trying to redefine the name in some parts > of the configuration but not others. Hope the above explanation > helps. I've reread your comment That is, the name you've written in the proxy_pass directive is the ac

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

2020-06-02 Thread Maxim Dounin
Hello! On Tue, Jun 02, 2020 at 12:10:45PM -0700, PGNet Dev wrote: > On 6/2/20 8:27 AM, Francis Daly wrote: > > That suggests that if you choose to use "proxy_ssl_server_name on;", > > then you almost certainly do not want to add your own "proxy_set_header > > Host" value. > > > > The nginx code

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

2020-06-02 Thread Maxim Dounin
Hello! On Tue, Jun 02, 2020 at 04:27:28PM +0100, Francis Daly wrote: > On Tue, Jun 02, 2020 at 12:51:55PM +0300, Sergey Kandaurov wrote: > > Hi there, > > > That means client provided TLS "server_name" extension (SNI), > > then requested a different origin in the Host header. > > That suggests

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

2020-06-02 Thread PGNet Dev
On 6/2/20 8:27 AM, Francis Daly wrote: > That suggests that if you choose to use "proxy_ssl_server_name on;", > then you almost certainly do not want to add your own "proxy_set_header > Host" value. > > The nginx code probably should not try to check for (and reject) that > combination of directiv

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

2020-06-02 Thread Francis Daly
On Tue, Jun 02, 2020 at 12:51:55PM +0300, Sergey Kandaurov wrote: Hi there, > That means client provided TLS "server_name" extension (SNI), > then requested a different origin in the Host header. That suggests that if you choose to use "proxy_ssl_server_name on;", then you almost certainly do no

RE: Re: proxy_ssl_verify error: 'upstream SSL certificate does not m

2020-06-02 Thread 7149144120
Stop -Original Message- From: Sent: Tue, 2 Jun 2020 12:51:55 +0300 To: 7149144...@txt.att.net Subject: Re: proxy_ssl_verify error: 'upstream SSL certificate does not m > >> On 2 Jun 2020, at 07:58, PGNet Dev wrote: >> >> 2020/06/02 00:50:08 [info] 20166#20166: *3 client

RE: Re: proxy_ssl_verify error: 'upstream SSL certificate does not m

2020-06-02 Thread 7149144120
Stop -Original Message- From: Sent: Mon, 1 Jun 2020 21:43:20 -0700 To: 7149144...@txt.att.net Subject: Re: proxy_ssl_verify error: 'upstream SSL certificate does not m >On 6/1/20 8:42 AM, Maxim Dounin wrote: >> >> proxy_ssl_server_name on; >> >> to see if it helps. See

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

2020-06-02 Thread Sergey Kandaurov
> On 2 Jun 2020, at 07:58, PGNet Dev wrote: > > 2020/06/02 00:50:08 [info] 20166#20166: *3 client attempted to request > the server name different from the one that was negotiated while reading > client request headers, client: 127.0.0.1, server: test.example.net, request: > "GET /app1