From 8edd063114c2f0c5931643d6b75cea13a93da636 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Tue, 18 Jan 2022 08:04:16 +0100 Subject: core.certmanager: Apply TLS preset before global settings (thanks Menel) Allows overriding settings via the global 'ssl' settings as before. This order was probably accidental. That said, 'ssl' is a giant footgun we will want to discourage use of. --- core/certmanager.lua | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'core') diff --git a/core/certmanager.lua b/core/certmanager.lua index bde98621..a7a44a4c 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -350,11 +350,11 @@ local function create_context(host, mode, ...) -- We can't read the password interactively when daemonized password = function() log("error", "Encrypted certificate for %s requires 'ssl' 'password' to be set in config", host); end; }); - cfg:apply(global_ssl_config); local preset = configmanager.get("*", "tls_preset") or "intermediate"; if preset ~= "legacy" then cfg:apply(mozilla_ssl_configs[preset]); end + cfg:apply(global_ssl_config); for i = select('#', ...), 1, -1 do cfg:apply(select(i, ...)); -- cgit v1.2.3