tree 8b90a63ca792d42d9d23c3ea08214dc7a9e0d778
parent 3169471964fdc49963e63f68c1fd88686821a0c4
author Emmanuel Hocdet <manu@gandi.net> 1502270665 +0200
committer Willy Tarreau <w@1wt.eu> 1502289028 +0200
encoding latin1

MINOR: ssl: allow to start without certificate if strict-sni is set

With strict-sni, ssl connection will fail if no certificate match. Have no
certificate in bind line, fail on all ssl connections. It's ok with the
behavior of strict-sni. When 'generate-certificates' is set 'strict-sni' is
never used. When 'strict-sni' is set, default_ctx is never used. Allow to start
without certificate only in this case.

Use case is to start haproxy with ssl before customer start to use certificates.
Typically with 'crt' on a empty directory and 'strict-sni' parameters.