sozu-proxy / sozu

Sōzu HTTP reverse proxy, configurable at runtime, fast and safe, built in Rust. It is awesome!
https://www.sozu.io/
GNU Affero General Public License v3.0
3.12k stars 194 forks source link

Remove duplicate certificate if certificate chain is a full chain file #1135

Open taladar opened 2 months ago

taladar commented 2 months ago

Currently sozu seems to include the certificate twice if the specified chain file includes the certificate (or is indeed the same file specified for the certificate option). Many ACME clients produce files like that so it might be helpful to detect the situation and remove the certificate from the start of the chain. This can be detected with e.g. the Qualys SSLLabs test or testssl