From fa7322365a22e82b1d37696d09d3bb264907fdc9 Mon Sep 17 00:00:00 2001 From: Daniel Santos Date: Thu, 27 Feb 2020 19:37:19 -0700 Subject: [PATCH] Only enforces SNI matching if ClientAuth is enabled (#3096) --- caddyhttp/httpserver/server.go | 1 + 1 file changed, 1 insertion(+) diff --git a/caddyhttp/httpserver/server.go b/caddyhttp/httpserver/server.go index 3dc5c9d9d..30a25919e 100644 --- a/caddyhttp/httpserver/server.go +++ b/caddyhttp/httpserver/server.go @@ -448,6 +448,7 @@ func (s *Server) serveHTTP(w http.ResponseWriter, r *http.Request) (int, error) // sites that rely on TLS ClientAuth sharing a port with // sites that do not - if mismatched, close the connection if !vhost.TLS.InsecureDisableSNIMatching && r.TLS != nil && + vhost.TLS.ClientAuth != tls.NoClientCert && strings.ToLower(r.TLS.ServerName) != strings.ToLower(hostname) { r.Close = true log.Printf("[ERROR] %s - strict host matching: SNI (%s) and HTTP Host (%s) values differ",