Have HAProxy do some minimal validation on the challenge (see end of §8.3 in RFC8555).

Andrea Cocito 2023-05-16 14:27:49 +02:00
parent 213c4f8da2
commit 7516fbcf37
1 changed files with 1 additions and 1 deletions

@ -85,7 +85,7 @@ Configure your webserver to respond statelessly to challenges for a given accoun
mode http
bind :80
bind :443 ssl crt /etc/haproxy/certs/
http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_beg '/.well-known/acme-challenge/' }
http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_reg '^/.well-known/acme-challenge/[-_a-zA-Z0-9]+$' }
```
3. Ok, you can issue cert now.
```