tree 66c0b308f7f6c1bf8672ba5c9311d3daf47b9509
parent ed54c3baa5c661346e24e6ed0c1fcdd8bd6cedb7
author Joao Morais <jcmoraisjr@gmail.com> 1605955340 -0300
committer Willy Tarreau <w@1wt.eu> 1605968962 +0100
encoding latin1

DOC: clarify how to create a fallback crt

HAProxy uses CN and SAN of the certificates to match incoming SNI, and
use the matching certificate in the TLS handshake. `crt-list` goes
further and allows to configure SNI filters to explicitly define the
FQDNs that should match a certificate.

The first declared certificate of the `crt-list` option follows the same
rules, and it's also used as a fallback - the certificate that should be
used if SNI isn't provided or the provided one cannot match any
certificate or SNI filter. If a provided SNI matches the CN or SAN of
the first certificate, the first certificate would be used even if a
matching SNI filter is declared later.

This change clarifies this scenario and documents a filter that can be
used to convert the first declared certificate as a proper fallback.

Should be merged as far as the first SNI filter implementation.