Have HAProxy do some minimal validation on the challenge (see end of §8.3 in RFC8555).
parent
213c4f8da2
commit
7516fbcf37
|
@ -85,7 +85,7 @@ Configure your webserver to respond statelessly to challenges for a given accoun
|
||||||
mode http
|
mode http
|
||||||
bind :80
|
bind :80
|
||||||
bind :443 ssl crt /etc/haproxy/certs/
|
bind :443 ssl crt /etc/haproxy/certs/
|
||||||
http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_beg '/.well-known/acme-challenge/' }
|
http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_reg '^/.well-known/acme-challenge/[-_a-zA-Z0-9]+$' }
|
||||||
```
|
```
|
||||||
3. Ok, you can issue cert now.
|
3. Ok, you can issue cert now.
|
||||||
```
|
```
|
||||||
|
|
Loading…
Reference in New Issue