[Suggestion] 应当默认开启“应用不存在时返回内置证书”

Open
#1,315 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
58/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
go
Domain
security

Research direction

Start by tracing the current handling of the “return the built-in certificate when the application does not exist” setting and TLS host matching. Confirm how requests for an IP or unknown TLS host currently select a certificate, then make the setting default to enabled while preserving the correct certificate for matching applications; verify both cases with the relevant existing tests.

Written by the indexing model from the issue text.

Description

Rejected
What would you like to be added or improved?

建议默认开启“应用不存在时返回内置证书”:
Image
理由如下：

  1. 未开启“应用不存在时返回内置证书”时，直接访问ip会漏证书，如果是套了CDN的需要隐藏源站ip的站点，直接用fofa可以把源站扫出来，对于那些刚尝试使用雷池的人安装雷池=漏源站
  2. 在其他比如nginx、apache等都是用户tls host对才返回对应的证书，哪里有tls host不对还把正确的证书传给访客的，这本身就不安全不符合规范，不符合开源实践
Why is it needed?

默认开启“应用不存在时返回内置证书”

Dominant language
Go
Stars
22.6k
Forks
1.5k
Avg merge
4h 30m
Merged PRs (30d)
11

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from chaitin/SafeLine

All issues in chaitin/SafeLine

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.