{"action":"created","issue":{"url":"https://api.github.com/repos/varnish/hitch/issues/276","repository_url":"https://api.github.com/repos/varnish/hitch","labels_url":"https://api.github.com/repos/varnish/hitch/issues/276/labels{/name}","comments_url":"https://api.github.com/repos/varnish/hitch/issues/276/comments","events_url":"https://api.github.com/repos/varnish/hitch/issues/276/events","html_url":"https://github.com/varnish/hitch/issues/276","id":344790632,"node_id":"MDU6SXNzdWUzNDQ3OTA2MzI=","number":276,"title":"Wrong certificate with no SNI after upgrading to 1.4.8","user":{"login":"bago","id":173498,"node_id":"MDQ6VXNlcjE3MzQ5OA==","avatar_url":"https://avatars1.githubusercontent.com/u/173498?v=4","gravatar_id":"","url":"https://api.github.com/users/bago","html_url":"https://github.com/bago","followers_url":"https://api.github.com/users/bago/followers","following_url":"https://api.github.com/users/bago/following{/other_user}","gists_url":"https://api.github.com/users/bago/gists{/gist_id}","starred_url":"https://api.github.com/users/bago/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bago/subscriptions","organizations_url":"https://api.github.com/users/bago/orgs","repos_url":"https://api.github.com/users/bago/repos","events_url":"https://api.github.com/users/bago/events{/privacy}","received_events_url":"https://api.github.com/users/bago/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-07-26T10:41:57Z","updated_at":"2018-07-26T14:38:19Z","closed_at":null,"author_association":"NONE","body":"I've upgraded from 1.4.4 to 1.4.8 in a \"multihomed\" setup (multiple IPs with their own certificates and multiple certificates for each IP). I had to skip 1.4.5, 1.4.6 and 1.4.7 because of issues handling the multihoming.\r\n\r\nNow, I just noticed that when the client does not support SNI, hitch 1.4.4 was using the FIRST \"pem-file\" for that frontend in the handshake. Now with 1.4.8 it sounds like with no SNI it uses a \"random\" certificate.\r\n\r\nCan you confirm the behaviour have been changed? Is it a bug or simply a change? Is there any workaround to force a specific certificate to be used when there is no SNI handshake?"},"comment":{"url":"https://api.github.com/repos/varnish/hitch/issues/comments/408119756","html_url":"https://github.com/varnish/hitch/issues/276#issuecomment-408119756","issue_url":"https://api.github.com/repos/varnish/hitch/issues/276","id":408119756,"node_id":"MDEyOklzc3VlQ29tbWVudDQwODExOTc1Ng==","user":{"login":"bago","id":173498,"node_id":"MDQ6VXNlcjE3MzQ5OA==","avatar_url":"https://avatars1.githubusercontent.com/u/173498?v=4","gravatar_id":"","url":"https://api.github.com/users/bago","html_url":"https://github.com/bago","followers_url":"https://api.github.com/users/bago/followers","following_url":"https://api.github.com/users/bago/following{/other_user}","gists_url":"https://api.github.com/users/bago/gists{/gist_id}","starred_url":"https://api.github.com/users/bago/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bago/subscriptions","organizations_url":"https://api.github.com/users/bago/orgs","repos_url":"https://api.github.com/users/bago/repos","events_url":"https://api.github.com/users/bago/events{/privacy}","received_events_url":"https://api.github.com/users/bago/received_events","type":"User","site_admin":false},"created_at":"2018-07-26T14:38:19Z","updated_at":"2018-07-26T14:38:19Z","author_association":"NONE","body":"The fact is that I'm not able to easily reproduce it..\r\n\r\nI find the server with wrong default certificates... I restart it and everything come back to normal (first certificate in the declaration is sent as default).\r\n\r\nI attempted adding a new certificate and doing an hot reload and everything is still ok... \r\n\r\nBTW the frontend confs are simple:\r\n\r\n```\r\nfrontend = {\r\n  host = \"IP.ADDRESS.1\"\r\n  port = \"443\"\r\n  pem-file = \"/etc/hitch/certs/defaultwildcard.pem\"\r\n  pem-file = \"/etc/hitch/certs/acmemanagedhost.pem\"\r\n  pem-file = \"/etc/hitch/certs/acmemanagedthirdhost.pem\"\r\n}\r\n```\r\n\r\nI have 4 frontends on 4 different IPs and the largest frontend uses 400 pem-files declarations.\r\nThe acme pems are added, removed, renewed often and I have multiple hitch hot reloads per day.\r\nThis \"first\" (default) certificate is never removed or added, but it is renewed.\r\n\r\nPS: doing some check I found that openssl client up to 1.1.0 does not use SNI if you don't use -servername directive, but with openssl 1.1.1  you have to use -noservername directive, otherwise it will pass servername depending on the host used to connect."}}
{"actor":{"display_login":"bago"}}