tree 9ba5292233b953de957373e23d09d52ff62c4e3e
parent 8218aed90e862ed01c2a8bb9bf81e6d1a90f14db
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1616752070 +0100
committer William Lallemand <wlallemand@haproxy.org> 1616760399 +0100

BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one

If the first active line of a crt-list file is also the first mentioned
certificate of a frontend that does not have the strict-sni option
enabled, then its certificate will be used as the default one. We then
do not want this instance to be removable since it would make a frontend
lose its default certificate.
Considering that a crt-list file can be used by multiple frontends, and
that its first mentioned certificate can be used as default certificate
for only a subset of those frontends, we do not want the line to be
removable for some frontends and not the others. So if any of the ckch
instances corresponding to a crt-list line is a default instance, the
removal of the crt-list line will be forbidden.

It can be backported as far as 2.2.