I'm on -current, httpd throws tls misconfig error when different cipher or ecdhe used but it's bypassed by listen statment.
server "domain.tld" { listen on * tls port 443 log style combined hsts { subdomains } root "/htdocs/domain.tld/" tls { certificate "/etc/ssl/domain.tld.fullchain.pem" key "/etc/ssl/private/domain.tld.key" ciphers "HIGH:!AES128:!kRSA:!aNULL" ecdhe "P-384,P-256,X25519" } location "/pub/*" { directory auto index } location "/.well-known/mta-sts.txt" { root "/mta-sts" request strip 1 pass } location "/.well-known/acme-challenge/*" { root "/acme" request strip 2 } } server "sub.domain.tld" { # listen on <some_add> port <random_port> # note: adding before tls # listen on 0.0.0.0 port 8080 listen on * tls port 443 root "/htdocs/sub.domain.tld" tls { certificate "/etc/ssl/domain.tld.fullchain.pem" key "/etc/ssl/private/domain.tld.key" } hsts { max-age 15768000 preload subdomains } connection max request body 104857600 location "/*" { fastcgi { param SCRIPT_FILENAME "/cgi-bin/scm" param SCRIPT_NAME " " } } location "/.well-known/acme-challenge/*" { root "/acme" request strip 2 } } $ doas httpd -nv server "sub.domain.tld": tls configuration mismatch on same address/port instead of defining same cipher and ecdhe, uncommenting "listen on 0.0.0.0 port 8080" bypasses this error I'm unsure what causes this, can someone shed some light?