Commits on Jun 14, 2017

1. Donot serve certificate content for Non-SSL routes …

   By default, when a host does not resolve to a route in a HTTPS or tls
   sni request, the default cert is returned to the caller as part of the
   503 response. This exposes the default cert and may pose security
   concerns. Haproxy strict-sni option to bind suppresses use of the
   default cert.
   
   This adds a new environment variable to the router deployment controller,
   ROUTER_STRICT_SNI, to control bind processing. When set to "true" or
   "TRUE", "strict-sni" is added to the bind. Default is "false".
   
   oc adm router --strict-sni sets ROUTER_STRICT_SNI="true"
   
   bug 1369865
   https://bugzilla.redhat.com/show_bug.cgi?id=1369865

   

   pecameron committed Jun 14, 2017
   Configuration menu

   • View commit details
   • Copy full SHA for e8638ae
   • Browse repository at this point

   Copy the full SHA

   e8638ae View commit details

   Browse the repository at this point in the history