{"action":"created","issue":{"url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/76","repository_url":"https://api.github.com/repos/SWI-Prolog/packages-http","labels_url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/76/labels{/name}","comments_url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/76/comments","events_url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/76/events","html_url":"https://github.com/SWI-Prolog/packages-http/pull/76","id":196519597,"number":76,"title":"ENHANCED: HTTP Unix daemon now supports multiple certificates.","user":{"login":"triska","id":7482140,"avatar_url":"https://avatars.githubusercontent.com/u/7482140?v=3","gravatar_id":"","url":"https://api.github.com/users/triska","html_url":"https://github.com/triska","followers_url":"https://api.github.com/users/triska/followers","following_url":"https://api.github.com/users/triska/following{/other_user}","gists_url":"https://api.github.com/users/triska/gists{/gist_id}","starred_url":"https://api.github.com/users/triska/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/triska/subscriptions","organizations_url":"https://api.github.com/users/triska/orgs","repos_url":"https://api.github.com/users/triska/repos","events_url":"https://api.github.com/users/triska/events{/privacy}","received_events_url":"https://api.github.com/users/triska/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-12-19T21:01:38Z","updated_at":"2016-12-21T23:13:12Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/SWI-Prolog/packages-http/pulls/76","html_url":"https://github.com/SWI-Prolog/packages-http/pull/76","diff_url":"https://github.com/SWI-Prolog/packages-http/pull/76.diff","patch_url":"https://github.com/SWI-Prolog/packages-http/pull/76.patch"},"body":"Simply supply several --certfile and --keyfile options. Their relative\r\norder must be identical, for example cert1, cert2, ..., key1, key2, or\r\ncert1, key1, cert2, key2, ... etc.\r\n\r\nThus, you can host dual-stack RSA/ECDSA HTTPS servers, for example."},"comment":{"url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/comments/268668888","html_url":"https://github.com/SWI-Prolog/packages-http/pull/76#issuecomment-268668888","issue_url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/76","id":268668888,"user":{"login":"triska","id":7482140,"avatar_url":"https://avatars.githubusercontent.com/u/7482140?v=3","gravatar_id":"","url":"https://api.github.com/users/triska","html_url":"https://github.com/triska","followers_url":"https://api.github.com/users/triska/followers","following_url":"https://api.github.com/users/triska/following{/other_user}","gists_url":"https://api.github.com/users/triska/gists{/gist_id}","starred_url":"https://api.github.com/users/triska/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/triska/subscriptions","organizations_url":"https://api.github.com/users/triska/orgs","repos_url":"https://api.github.com/users/triska/repos","events_url":"https://api.github.com/users/triska/events{/privacy}","received_events_url":"https://api.github.com/users/triska/received_events","type":"User","site_admin":false},"created_at":"2016-12-21T23:13:12Z","updated_at":"2016-12-21T23:13:12Z","body":"Since there are now many simultaneous issues being raised, I would like to factor out the configuration discussion, for which I have filed #77.\r\n\r\nRegarding the \"HTTPS inside a LAN\", my input is: You only need control over a *single* host that is accessible from the web to obtain many certificates from *Let's&nbsp;Encrypt*. For example, with control over `swi-prolog.org`, you could get certificates for:\r\n\r\n- `machine1.swi-prolog.org`\r\n- `machine2.swi-prolog.org`\r\n- etc.\r\n\r\nYou can deploy these certificates to the machines inside your LAN, and then resolve access to `machine1.swi-prolog.org` for machines that are inside your&nbsp;LAN internally, by letting the configuration of these machines point to the local environment.\r\n\r\nUsing SNI allows you to supply a server name that can be different from the host name of the machine. The above works even without SNI, but SNI could help if you want to call your internal machines differently. Note that SWI-Prolog currently provides no way to supply an SNI `-servername` (that's how the `openssl` option is called) that is *different* from the hostname, but it could be useful to have such an option. Currently, `host/1` is used as the the servername for&nbsp;SNI too. I could (and probably will) add an option `servername/1` that supplies a name that is used for&nbsp;SNI, and which can diverge from the host name.\r\n\r\nNote also that the SNI name is transmitted (of course) *before* a secure connection has been established. In other words, the SNI name is transmitted in **plain&nbsp;text**, and therefore exposes the host name that the client used for establishing the connection! This is definitely not wanted in some cases, since it potentially tells an adversary details about your network configuration. Consequently, there should also be an option to *disable* SNI for the client, and I will likely add that as&nbsp;well."}}
{"actor":{"display_login":"triska"}}