I'm on -current, httpd throws tls misconfig error when different
cipher or ecdhe used but it's bypassed by listen statment.

server "domain.tld" {
    listen on * tls port 443
    log style combined
    hsts 
    {
        subdomains
    }
    root "/htdocs/domain.tld/"   
    tls {
        certificate "/etc/ssl/domain.tld.fullchain.pem"
        key "/etc/ssl/private/domain.tld.key"
        ciphers "HIGH:!AES128:!kRSA:!aNULL"
        ecdhe "P-384,P-256,X25519"
    }
    location "/pub/*" {
        directory auto index
    }
    location "/.well-known/mta-sts.txt" {
        root "/mta-sts"
        request strip 1
        pass
    }
    location "/.well-known/acme-challenge/*" {
        root "/acme"
        request strip 2
    }
}

server "sub.domain.tld" { 
    # listen on <some_add> port <random_port>
    # note: adding before tls 
    # listen on 0.0.0.0 port 8080
    listen on * tls port 443
    root "/htdocs/sub.domain.tld"
    tls {
            certificate "/etc/ssl/domain.tld.fullchain.pem"
            key "/etc/ssl/private/domain.tld.key"
    }
    hsts {
            max-age 15768000
            preload
            subdomains
    }
    connection max request body 104857600
    location  "/*" {
        fastcgi { 
            param SCRIPT_FILENAME "/cgi-bin/scm"
            param SCRIPT_NAME " "
        }
    }
    location "/.well-known/acme-challenge/*" {
            root "/acme"
            request strip 2
    }
}


$ doas httpd -nv
server "sub.domain.tld": tls configuration mismatch on same address/port

instead of defining same cipher and ecdhe, uncommenting
"listen on 0.0.0.0 port 8080"
bypasses this error

I'm unsure what causes this, can someone shed some light?

Reply via email to