aboutsummaryrefslogtreecommitdiffstats
path: root/core/certmanager.lua
Commit message (Collapse)AuthorAgeFilesLines
* core.certmanager: Apply TLS preset before global settings (thanks Menel)Kim Alvefur2022-01-181-1/+1
| | | | | | Allows overriding settings via the global 'ssl' settings as before. This order was probably accidental. That said, 'ssl' is a giant footgun we will want to discourage use of.
* core.certmanager: Disable DANE name checks (not needed for XMPP)Kim Alvefur2021-09-161-1/+1
| | | | | | | Pending https://github.com/brunoos/luasec/pull/179 Should not be done globally, but rather only for s2sout, but that would have to be in mod_tls then.
* core.certmanager: Add curveslist to 'old' Mozilla TLS presetKim Alvefur2021-12-261-1/+2
| | | | | | | Unsure if this was overlooked before or a recent addition. Reproduced the data from JSON file available. Would be nice to have a tool that does that.
* core.certmanager: Check index for wildcard certsKim Alvefur2021-12-221-1/+2
|
* prosodyctl cert: use the indexing functions for better UXJonas Schäfer2021-12-211-6/+14
| | | | | | These provide (a) a way to deal with random assortments of certs and (b) avoid unnecessary error messages and warnings, according to #1669 anyway, which this fixes.
* core.certmanager: Rename preset option to 'tls_preset'Kim Alvefur2021-12-221-1/+1
| | | | TLS good, SSL bad.
* core.certmanager: Add "legacy" preset for keeping previous default settingsKim Alvefur2021-12-221-1/+3
| | | | If anyone wants that.
* core.certmanager: Add TLS 1.3 cipher suites to Mozilla TLS presetsKim Alvefur2021-11-031-1/+7
|
* core.certmanager: Presets based on Mozilla SSL Configuration GeneratorKim Alvefur2019-12-221-0/+60
| | | | ssl_preset = "modern"
* core.certmanager: Support 'use_dane' setting to enable DANE supportKim Alvefur2021-07-181-0/+2
| | | | | | Removes the need to enable DANE with two separate settings. Previously you had to also set `ssl = { dane = true }` to activate DANE support in LuaSec and OpenSSL.
* core.certmanager: Skip service certificate lookup for https clientKim Alvefur2021-05-271-1/+2
| | | | | | Quick Fix\u{2122} to stop prevent certmanager from automatically adding a client certificate for net.http.request, since this normally does not require such.
* Merge 0.11->trunkMatthew Wild2021-05-131-9/+12
|\
| * certmanager: Disable renegotiation by defaultMatthew Wild2021-05-111-0/+2
| | | | | | | | This requires LuaSec 0.7+ and OpenSSL 1.1.1+
| * core.certmanager: Test for SSL options in absence of LuaSec configKim Alvefur2021-04-261-5/+9
| |
| * core.certmanager: Attempt to directly access LuaSec config tableKim Alvefur2021-04-261-1/+1
| | | | | | | | | | Due to a bug this field was not properly exported before See https://github.com/brunoos/luasec/issues/149
| * core.certmanager: Move EECDH ciphers before EDH in default cipherstring ↵Kim Alvefur2019-08-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (fixes #1513) Backport of 94e341dee51c The original intent of having kEDH before kEECDH was that if a `dhparam` file was specified, this would be interpreted as a preference by the admin for old and well-tested Diffie-Hellman key agreement over newer elliptic curve ones. Otherwise the faster elliptic curve ciphersuites would be preferred. This didn't really work as intended since this affects the ClientHello on outgoing s2s connections, leading to some servers using poorly configured kEDH. With Debian shipping OpenSSL settings that enforce a higher security level, this caused interoperability problems with servers that use DH params smaller than 2048 bits. E.g. jabber.org at the time of this writing has 1024 bit DH params. MattJ says > Curves have won, and OpenSSL is less weird about them now
* | core.certmanager: Catch error from lfsKim Alvefur2021-05-071-1/+11
| | | | | | | | | | | | | | lfs.dir() throws a hard error if there's a problem, e.g. no such directory or permission issues. This also gets called early enough that the main loop error protection hasn't been brought up yet, causing a proper crash.
* | core.certmanager: Resolve certs path relative to config dirKim Alvefur2021-05-071-3/+3
| | | | | | | | | | | | | | | | | | Otherwise the default "certs" would be relative to $PWD, which works when testing from a source checkout, but not on installed systems where it usually points to the data directory. Also, the LuaFileSystem dir() iterator throws a hard error, which may cause a crash or other problems.
* | core.certmanager: Skip directly to guessing of key from cert filenameKim Alvefur2021-05-051-2/+17
| | | | | | | | Cuts down on a ton of debug logs
* | core.certmanager: Join paths with OS-aware util.paths functionKim Alvefur2021-05-051-2/+3
| | | | | | | | Right thing to do, rather than hardcoding '/'
* | core.certmanager: Build an index over certificatesKim Alvefur2021-04-101-0/+79
| |
* | core.certmanager: Check for complete filenameKim Alvefur2021-04-101-1/+1
| | | | | | | | Prevents a false positive match on files with fullchain.pem as suffix
* | core.certmanager: Add comments explaining the 'verifyext' TLS settingsKim Alvefur2021-02-061-1/+4
| | | | | | | | | | | | | | Thanks to debacle for reminding me, in the context of mod_auth_ccert I wonder if we still need lsec_ignore_purpose, Let's Encrypt seems to include both client and server purposes in certs.
* | core.certmanager: Add TODO about LuaSec issueKim Alvefur2020-06-071-0/+3
| |
* | Merge 0.11->trunkKim Alvefur2020-04-101-6/+8
|\|
| * core.certmanager: Look for privkey.pem to go with fullchain.pem (fix #1526)Kim Alvefur2020-04-101-6/+8
| | | | | | | | | | | | | | This makes `prosodyctl cert import example.com /path/to/example.com/fullchain.pem` work. This was never intended to, yet users commonly tried this and got problems.
* | core.portmanager: Fix TLS context inheritance for SNI hosts (completes SNI ↵Kim Alvefur2019-11-291-0/+1
| | | | | | | | support)
* | core.certmanager: Lower severity for tls config not having certKim Alvefur2019-09-071-2/+4
| | | | | | | | | | | | | | This is needed for SNI where certificates are in separate per-hostname contexts, not the main one. If there is a cert, it will still require a corresponding key.
* | core.certmanager: Remove unused import [luacheck]Kim Alvefur2019-08-251-1/+0
| |
* | Remove COMPAT with temporary luasec forkKim Alvefur2019-08-251-7/+0
| | | | | | | | | | The changes in the temporary fork were merged into mainline luasec ca 2013 and included in the 0.5 release in 2014.
* | core.certmanager: Move EECDH ciphers before EDH in default cipherstringKim Alvefur2019-08-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The original intent of having kEDH before kEECDH was that if a `dhparam` file was specified, this would be interpreted as a preference by the admin for old and well-tested Diffie-Hellman key agreement over newer elliptic curve ones. Otherwise the faster elliptic curve ciphersuites would be preferred. This didn't really work as intended since this affects the ClientHello on outgoing s2s connections, leading to some servers using poorly configured kEDH. With Debian shipping OpenSSL settings that enforce a higher security level, this caused interoperability problems with servers that use DH params smaller than 2048 bits. E.g. jabber.org at the time of this writing has 1024 bit DH params. MattJ says > Curves have won, and OpenSSL is less weird about them now
* | core.certmanager: Do not ask for client certificates by defaultKim Alvefur2019-03-101-1/+1
|/ | | | | | Since it's mostly only mod_s2s that needs to request client certificates it makes some sense to have mod_s2s ask for this, instead of having eg mod_http ask to disable it.
* Merge 0.10->trunkKim Alvefur2018-05-251-1/+1
|\
| * core.certmanager: Allow all non-whitespace in service name (fixes #1019)Kim Alvefur2018-05-251-1/+1
| |
* | vairious: Add annotation when an empty environment is set [luacheck]Kim Alvefur2018-02-281-0/+1
|/
* certmanager: Check for missing certificate before key in configuration ↵Kim Alvefur2017-12-281-1/+1
| | | | (should be marginally less confusing)
* certmanager: Set single curve conditioned on LuaSec advertising EC crypto ↵Kim Alvefur2017-11-201-1/+1
| | | | support
* certmanager: Filter out curves not supported by LuaSecKim Alvefur2017-11-201-0/+12
|
* certmanager: Change table representing LuaSec capabilities to match ↵Kim Alvefur2017-11-201-13/+20
| | | | capabilities table exposed in LuaSec 0.7
* core.certmanager: Set a default curveslist [sic], fixes #879, #943, #951 if ↵Kim Alvefur2017-09-271-0/+6
| | | | used along with luasec 0.7 and openssl 1.1
* prosodyctl: cert import: Reuse function from certmanager for locating ↵Kim Alvefur2017-09-271-0/+1
| | | | certificates and keys
* certmanager: Add debug logging (thanks av6)Matthew Wild2017-09-231-0/+4
|
* certmanager: Update the 'certificates' option after the config has been ↵Kim Alvefur2017-06-011-0/+1
| | | | reloaded (fixes #929)
* core.certmanager: Translate "no start line" to something friendlier (thanks ↵Kim Alvefur2016-11-261-0/+5
| | | | santiago)
* core.certmanager: Split cipher list into array with comments explaining each ↵Kim Alvefur2016-09-121-1/+10
| | | | part
* certmanager: Assume default config path of '.' (fixes prosodyctl check certs ↵Kim Alvefur2016-07-291-1/+1
| | | | when not installed)
* certmanager: Explicitly tonumber() version number segments before doing ↵Matthew Wild2016-03-261-1/+1
| | | | arithmetic and avoid relying on implicit coercion (thanks David Favro)
* certmanager: Localize tonumberMatthew Wild2016-02-181-1/+1
|
* certmanager: Try filename.key if certificate is set to a full filename ↵Kim Alvefur2016-02-051-3/+2
| | | | ending with .crt
* certmanager: Apply global ssl config later so certificate/key is not ↵Kim Alvefur2016-02-051-1/+1
| | | | overwritten by magic
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-18 05:46:47 +0000