GlenDC
commented
1 month ago - cert improvements have been made (self-signed server is now correct)
- in-memory issuer is now possible with boring: note that no caching is done yet, so each connection a cert is generated, so someone can probably help improve this if desired
Follow up issues will be made.
We make this available as:
- lib code, so mitm proxies can use it
roxy certcmd that can be used to generate a cert, but also as a cert daemon to request these, which can be useful for folks that want to run a cert gen service separate
Currently the MITM proxy uses its own (tls) cert as presented cert. However, better would be that it uses this as the CA cert to generate and sign per-domain certs.
For now we can keep this basic, in a future release a lot more advanced.