<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #737278;">
<a href="https://gitlab.com/mihaelmilea">Mihael Milea</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1599">#1599</a>
</p>
<div class="md" style="position: relative; z-index: 1; color: #28272d; word-wrap: break-word;">
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">I have a setup with squid 5.7 (which uses GnuTLS) on debian 12 with multiple domains and Let's Encrypt certificates with wildcards for each domain. Let's say I have</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">domain1 with cert1 for domain1 *.domain1
domain2 with cert2 for domain2, *.domain2</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">the squid.conf contains:</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">https_port 443 accel defaultsite=something <br style="margin-top: 0;">
tls-cert=/cert1/fullchain.pem tls-key=/cert1/privkey.pem <br>
tls-cert=/cert2/fullchain.pem tls-key=/cert2/privkey.pem</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">Now the result:</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial"><a href="https://domain1" rel="nofollow noreferrer noopener" target="_blank" style="margin-top: 0;">https://domain1</a> => good, squid uses cert1
<a href="https://subdomain.domain1" rel="nofollow noreferrer noopener" target="_blank">https://subdomain.domain1</a> => good, squid uses cert1
<a href="https://domain2" rel="nofollow noreferrer noopener" target="_blank">https://domain2</a> => good, squid uses cert2
<a href="https://subdomain.domain2" rel="nofollow noreferrer noopener" target="_blank">https://subdomain.domain2</a> => BAD, squid fails to identify that this is a subdomain of domain2 that matches the wild card *.domain2 and then squid deploys cert1 instead, resulting in a browser warning that the certificate is not for the requested subdomain.domain2!</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">I submitted this as a bug in the squid bug report - <a href="https://bugs.squid-cache.org/show_bug.cgi?id=5467" rel="nofollow noreferrer noopener" target="_blank" style="margin-top: 0;">https://bugs.squid-cache.org/show_bug.cgi?id=5467</a> - and I was told that it is GnuTLS that identifies which subdomain.domain combination is used and it is also GnuTLS that chooses which certificate to deploy - is this true? If yes, then the bug is about GnuTLS failing to identify a certificate generated with wildcards when a subdomain of that domain is used.</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">Thank you for any help and input!</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">mihael</p>
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: .3em; border-bottom-width: 1px; border-bottom-color: #bfbfc3; border-bottom-style: solid; color: #28272d; margin: 24px 0 0;" align="initial">
<a href="#version-of-gnutls-used-i-dont-know-how-to-identify-which-gnutls-version-was-used-when-squid-57-was-compiled-for-debian-12" aria-hidden="true" class="anchor" id="user-content-version-of-gnutls-used-i-dont-know-how-to-identify-which-gnutls-version-was-used-when-squid-57-was-compiled-for-debian-12" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Version of gnutls used: I don't know how to identify which GnuTLS version was used when squid 5.7 was compiled for debian 12.</h2>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #737278;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1599">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/6d5cc2cdc98a4a9d90390ab91eea41b5/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1599"}}</script>
</p>
</div>
</body>
</html>