Re: [Pound Mailing List] Connection reset on non-SSL sites instead of presenting first SSL mentioned in configuration

Hello Freja,

The HeadRequire should be what you require for this but can you send us
over a quick example it maybe just your make up of the required match value.



On 23 October 2015 at 14:37, Freja Borginger <freja.borginger-w/[email protected]>
wrote:

> Hello,
>
>
>
> We’re hosting a bunch of both SSL and non-SSL enabled sites and we’re
> using pound for SSL-termination.
>
>
>
> The issue appears when someone visits a non-SSL enabled site by prepending
> https:// to the address.
>
> I’m expecting a connection reset or similar because this site doesn’t have
> SSL to begin with.
>
> But instead of that I get “This is an untrusted connection” in the browser
> and I see that pound serves up the first certificate it specified in the
> configuration.
>
>
>
> I tried adding HeadRequire in the Service section of the HTTPS section
> with all the SSL-enabled sites only, but it didn’t work as expected.
>
> If I understand it correctly those headers are sent encrypted, so they’re
> only sent after the encrypted connection has been fully established, and
> then it’s too late.
>
>
>
> I suppose this could only be done during the SNI negotiation phase when
> the server name is sent by the browser. Then I’d guess pound would check if
> the sent server name has a certificate. If it doesn’t then a connection
> reset or similar should happen.
>
>
>
> How would I achieve this? Or am I missing something?
>
>
>
> Thanks
>
>
>
> Freja Borginger
>
> IT
>
>
>



-- 
With Kind Regards.

Scott McKeown
Loadbalancer.org
http://www.loadbalancer.org
Tel (UK) - +44 (0) 3303801064 (24x7)
Tel (US) - +1 888.867.9504 (Toll Free)(24x7)